CVE-2021-23364
Summary
| CVE | CVE-2021-23364 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-04-28 16:15:00 UTC |
|---|
| Updated | 2023-08-08 14:22:00 UTC |
|---|
| Description | The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Fix unsafe regexp · browserslist/browserslist@c091916 · GitHub |
MISC |
github.com |
|
| Regular Expression Denial of Service (ReDoS) in browserslist | Snyk |
MISC |
snyk.io |
|
| Regular Expression Denial of Service (ReDoS) in org.webjars.npm:browserslist | Snyk |
MISC |
snyk.io |
|
| github.com/browserslist/browserslist/blob/e82f32d1d4100d6bc79ea0b6b6a2d2... |
MISC |
github.com |
|
| Fix ReDoS by yetingli · Pull Request #593 · browserslist/browserslist · GitHub |
MISC |
github.com |
|
| browserslist/index.js at e82f32d1d4100d6bc79ea0b6b6a2d281a561e33c · browserslist/browserslist · GitHub |
MITRE |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Yeting Li
Legacy QID Mappings
- 179724 Debian Security Update for node-browserslist (CVE-2021-23364)
- 982406 Nodejs (npm) Security Update for browserslist (GHSA-w8qv-6jwh-64r5)
