CVE-2021-33587: High severity css-what vulnerability
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-33587?
The severity of CVE-2021-33587 is high with a severity value of 7.5.
Which software versions are affected by CVE-2021-33587?
The css-what package versions 4.0.0 through 5.0.0 for Node.js are affected by CVE-2021-33587.
How does CVE-2021-33587 impact the css-what package for Node.js?
CVE-2021-33587 impacts the css-what package for Node.js by not ensuring that attribute parsing has Linear Time Complexity relative to the size of the input.
Is there a fix available for CVE-2021-33587?
Yes, a fix is available for CVE-2021-33587. It can be found in the css-what package version 5.0.1.
Where can I find more information about CVE-2021-33587?
More information about CVE-2021-33587 can be found at the following references: [Reference 1](https://github.com/fb55/css-what/releases/tag/v5.0.1), [Reference 2](https://lists.debian.org/debian-lts-announce/2023/03/msg00001.html), [Reference 3](https://security.netapp.com/advisory/ntap-20210706-0007/).