medium5.3
CVE-2021-23364
The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
Impact
The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Browserslist Project | Browserslist | from 4.0.0 before 4.16.5 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/browserslist/browserslist/blob/e82f32d1d4100d6bc79ea0b6b6a2d281a561e33c/index.js%23L472-L474
- https://github.com/browserslist/browserslist/commit/c091916910dfe0b5fd61caad96083c6709b02d98
- https://github.com/browserslist/browserslist/pull/593
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1277182
- https://snyk.io/vuln/SNYK-JS-BROWSERSLIST-1090194
- https://github.com/browserslist/browserslist/blob/e82f32d1d4100d6bc79ea0b6b6a2d281a561e33c/index.js%23L472-L474
- https://github.com/browserslist/browserslist/commit/c091916910dfe0b5fd61caad96083c6709b02d98
- https://github.com/browserslist/browserslist/pull/593
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1277182
- https://snyk.io/vuln/SNYK-JS-BROWSERSLIST-1090194