CVE-2021-33587

HIGH

css-what 4.0.0-5.0.0 - Denial of Service via Attribute Parsing

Title source: llm

Description

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.

References (3)

Core 3

Core References

Mailing List mailing-list

https://lists.debian.org/debian-lts-announce/2023/03/msg00001.html

Patch, Release Notes, Third Party Advisory

https://github.com/fb55/css-what/releases/tag/v5.0.1

Third Party Advisory

https://security.netapp.com/advisory/ntap-20210706-0007/

Scores

CVSS v3 7.5

EPSS 0.0019

EPSS Percentile 40.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

Status published

Products (4)

css-what_project/css-what 4.0.0

css-what_project/css-what 5.0.0

netapp/e-series_performance_analyzer

npm/css-what 4.0.0 - 5.0.1npm

Published May 28, 2021

Tracked Since Feb 18, 2026