GitHub Advisoryadvisory · npm

GHSA-wxhq-pm8v-cw75 Regular Expression Denial of Service in clean-css

LOW Published 2019-06-05 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
clean-css
Severity
Low
Weaknesses
CWE-1333
Reviewed
2019-06-05

Affected packages

• npm clean-css: < 4.1.11 → fixed in 4.1.11

Description

Version of `clean-css` prior to 4.1.11 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service. Recommendation Upgrade to version 4.1.11 or higher.

Related

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References