CVE-2021-23382: Postcss

High severity, CVSS 7.5. EPSS: 2.6% chance of exploitation in the next 30 days.

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).

Affected products

• Postcss Postcss: before 7.0.36 (fixed in 7.0.36); from 8.0.0, before 8.2.13 (fixed in 8.2.13)

Published 2021-04-26. Last modified 2026-06-17.