CVE-2021-23368: Postcss

Medium severity, CVSS 5.3. EPSS: 3.5% chance of exploitation in the next 30 days.

The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.

Affected products

• Postcss Postcss: from 7.0.0, before 7.0.36 (fixed in 7.0.36); from 8.0.0, before 8.2.10 (fixed in 8.2.10)

Published 2021-04-12. Last modified 2026-06-17.