CVE-2021-23382

Name	CVE-2021-23382
Description	The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\\s sourceMappingURL=(.*).
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-postcss (PTS)	bookworm	8.4.20+~cs8.0.23-1+deb12u1	fixed
	trixie	8.4.49+~cs9.2.32-1	fixed
	forky, sid	8.5.26+~cs10.2.24-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-postcss	source	(unstable)	8.2.1+~cs5.3.23-7

Notes

[buster] - node-postcss <no-dsa> (Minor issue)
https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640
https://github.com/postcss/postcss/commit/2ad1ca9b965dde32223bee28dc259c339cbaaa05 (8.2.13)