{"id":"GHSA-hpx4-r86g-5jrg","summary":"@adobe/css-tools Regular Expression Denial of Service (ReDOS) while Parsing CSS","details":"### Impact\n@adobe/css-tools version 4.3.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.\n\n### Patches\nThe issue has been resolved in 4.3.1.\n\n### Workarounds\nNone\n\n### References\nN/A\n\n","aliases":["CVE-2023-26364"],"modified":"2026-05-04T09:00:06.508008953Z","published":"2023-08-29T23:33:26Z","database_specific":{"nvd_published_at":"2023-11-17T14:15:21Z","cwe_ids":["CWE-1333","CWE-20"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2023-08-29T23:33:26Z"},"references":[{"type":"WEB","url":"https://github.com/adobe/css-tools/security/advisories/GHSA-hpx4-r86g-5jrg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26364"},{"type":"WEB","url":"https://github.com/adobe/css-tools/commit/2b09a25d1dbdbb16fe80065e4c9beb5623ee5793"},{"type":"PACKAGE","url":"https://github.com/adobe/css-tools"}],"affected":[{"package":{"name":"@adobe/css-tools","ecosystem":"npm","purl":"pkg:npm/%40adobe/css-tools"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.3.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-hpx4-r86g-5jrg/GHSA-hpx4-r86g-5jrg.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L"}]}