Security Alert - Package: postcss; Severity: MODERATE

[phenggeler]

    Affected package: postcss
    Ecosystem: NPM
    Affected version range: < 8.2.13

    Summary: Regular Expression Denial of Service in postcss
    Description: The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).
    identifiers: [{'type': 'GHSA', 'value': 'GHSA-566m-qj78-rww5'}, {'type': 'CVE', 'value': 'CVE-2021-23382'}]

    Fixed Version: 8.2.13
    Created Date = January 25, 2022

    

    ---
    
    Affected package: postcss
    Ecosystem: NPM
    Affected version range: >= 7.0.0, < 7.0.36

    Summary: Regular Expression Denial of Service in postcss
    Description: The npm package `postcss` from 7.0.0 and before versions 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.
    identifiers: [{'type': 'GHSA', 'value': 'GHSA-hwj9-h5mp-3pm3'}, {'type': 'CVE', 'value': 'CVE-2021-23368'}]

    Fixed Version: 7.0.36
    Created Date = January 25, 2022

    

    ---