CVE-2021-33587: Css-What Project Css-What

High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days.

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.

Affected products

• Css-What Project Css-What: version 4.0.0 only; version 5.0.0 only
• Netapp E-Series Performance Analyzer: affected versions not specified

Published 2021-05-28. Last modified 2026-06-17.