Fix CVE–2021–23364

[debricked-staging]

CVE–2021–23364

Vulnerable dependency:     browserslist (npm)    4.16.3

Vulnerability details

Description

GitHub

Regular Expression Denial of Service in browserslist

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

NVD

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

CVSS details - 5.3

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity	None
Availability	Low

References

    NVD - CVE-2021-23364
    Regular Expression Denial of Service in browserslist · CVE-2021-23364 · GitHub Advisory Database · GitHub
    Fix unsafe regexp · browserslist/browserslist@c091916 · GitHub
    Fix ReDoS by yetingli · Pull Request #593 · browserslist/browserslist · GitHub
    MISC
    browserslist/index.js at e82f32d1d4100d6bc79ea0b6b6a2d281a561e33c · browserslist/browserslist · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE