CVE-2021-33587: 
JavaScript vulnerability analysis and mitigation

CVE-2021-33587 affects the css-what package versions 4.0.0 through 5.0.0 for Node.js. The vulnerability was discovered and disclosed on May 28, 2021. The issue specifically relates to attribute parsing functionality that does not ensure Linear Time Complexity relative to the size of the input (NVD, MITRE).

The vulnerability has been assigned a CVSS 3.1 Base Score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The attack vector is network-based, with low attack complexity, requiring no privileges or user interaction, and has an unchanged scope. While there are no impacts to confidentiality or integrity, the availability impact is rated as high (NetApp).

When successfully exploited, this vulnerability could lead to a Denial of Service (DoS) condition through non-linear time complexity in attribute parsing. The vulnerability affects the availability of the system while leaving confidentiality and integrity intact (NetApp).

The vulnerability is exploitable through the parse function due to insecure regular expression in the re_attr variable. The attack can be triggered remotely with low complexity, requiring no special privileges or user interaction (Debian LTS).

The vulnerability has been fixed in css-what version 5.0.1. The fix includes hand-rolled attribute parsing and slightly more permissive attribute values to ensure linear parsing time. Various distributions have also released patched versions: Ubuntu has fixed versions for multiple releases, and Debian has addressed it in version 2.1.0-1+deb10u1 for Debian 10 (buster) (GitHub, Debian LTS).