Vulnerability · Published Apr 28, 2021 · Assigned by snyk
CVE-2021-23364Regular Expression Denial of Service (ReDoS)
Medium 5.3
In plain English
A medium-severity security flaw in browserslist. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)2.4%top 16.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-browserslist | 4.16.3+~cs5.4.72-2 | DEBIAN-CVE-2021-23364 |
| Debian:13 | node-browserslist | 4.16.3+~cs5.4.72-2 | DEBIAN-CVE-2021-23364 |
| Debian:14 | node-browserslist | 4.16.3+~cs5.4.72-2 | DEBIAN-CVE-2021-23364 |
| Ubuntu:22.04:LTS | node-browserslist | no fix listed | UBUNTU-CVE-2021-23364 |
| npm | browserslist | 4.16.5 | GHSA-w8qv-6jwh-64r5 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | browserslist | 4.0.0 – before unspecifiedunspecified – before 4.16.5 |
References
- https://snyk.io/vuln/SNYK-JS-BROWSERSLIST-1090194 x_refsource_MISC
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1277182 x_refsource_MISC
- https://github.com/browserslist/browserslist/blob/e82f32d1d4100d6bc79ea0b6b6a2d281a561e33c/index.js%23L472-L474 x_refsource_MISC
- https://github.com/browserslist/browserslist/commit/c091916910dfe0b5fd61caad96083c6709b02d98 x_refsource_MISC
- https://github.com/browserslist/browserslist/pull/593 x_refsource_MISC