|Description||The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.|
|Source||CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)|
Vulnerable and fixed packages
The table below lists information on source packages.
|sid, trixie, bookworm||6.1.0-5||fixed|
The information below is based on the following data on fixed versions.
[bullseye] - node-css-what <ignored> (Minor issue, intrusive to backport fixes to older series)
[buster] - node-css-what <ignored> (Minor issue, intrusive to backport fixes to older series)
[stretch] - node-css-what <end-of-life> (Nodejs in stretch not covered by security support)