What is GHSA-wxhq-pm8v-cw75?

GHSA-wxhq-pm8v-cw75 is a security advisory published by GitHub Security Advisories with Low severity. Regular Expression Denial of Service in clean-css

Why does GHSA-wxhq-pm8v-cw75 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-wxhq-pm8v-cw75?

GHSA-wxhq-pm8v-cw75 affects 1 product, including: npm/clean-css:\u003c 4.1.11.

GHSA-wxhq-pm8v-cw75LowDisclosed before NVD

Regular Expression Denial of Service in clean-css

Vendor

GitHub Security Advisories

Published

June 5, 2019

Last Modified

April 11, 2023

📋 Description

Version of clean-css prior to 4.1.11 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Recommendation

Upgrade to version 4.1.11 or higher.

🎯 Affected products1

npm/clean-css:< 4.1.11

🔗 References (3)

https://github.com/jakubpawlowicz/clean-css/commit/2929bafbf8cdf7dccb24e0949c70833764fa87e3
https://www.npmjs.com/advisories/785
https://github.com/advisories/GHSA-wxhq-pm8v-cw75