CVE-2021-23382

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).

• CWE-1333

• https://github.com/postcss/postcss/commit/2b1d04c867995e55124e0a165b7c6622c1735956Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1255641Exploit, Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640Exploit, Patch, Third Party Advisory
• https://github.com/postcss/postcss/commit/2b1d04c867995e55124e0a165b7c6622c1735956Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1255641Exploit, Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640Exploit, Patch, Third Party Advisory

Published

Apr 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23377This affects all versions of package onion-oled-js. If attac…9.8
• CVE-2021-23378This affects all versions of package picotts. If attacker-co…9.8
• CVE-2021-23379This affects all versions of package portkiller. If (attacke…9.8
• CVE-2021-2338Vulnerability in the Siebel Apps - Marketing product of Orac…6.1
• CVE-2021-23380This affects all versions of package roar-pidusage. If attac…7.3
• CVE-2021-23381This affects all versions of package killing. If attacker-co…9.8
• CVE-2021-23383The package handlebars before 4.7.7 are vulnerable to Protot…9.8
• CVE-2021-23384The package koa-remove-trailing-slashes before 2.0.2 are vul…5.4
• CVE-2021-23385This affects all versions of package Flask-Security. When us…6.1
• CVE-2021-23386This affects the package dns-packet before 5.2.2. It creates…6.5
• CVE-2021-23387The package trailing-slash before 2.0.1 are vulnerable to Op…6.1
• CVE-2021-23388The package forms before 1.2.1, from 1.3.0 and before 1.3.2 …5.3