CVE-2023-26364: Denial of Service of regular expression in package @adobe/css-tools

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-17 · updated 2026-06-17
Weakness: CWE-20

Description

@adobe/css-tools version 4.3.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a minor denial of service while attempting to parse CSS. Exploitation of this issue does not require user interaction or privileges.

Affected products

Adobe Css-Tools: before 4.3.1 — fixed in 4.3.1

How to fix

Upgrade to a fixed version: Adobe Css-Tools 4.3.1. Check the vendor advisory for mitigations.

References

https://github.com/adobe/css-tools/security/advisories/GHSA-hpx4-r86g-5jrg
https://github.com/adobe/css-tools/security/advisories/GHSA-hpx4-r86g-5jrg

Get alerted when CVE-2023-26364 or the next vulnerability affects your stack