| Package | Affected versions | Patched versions |
|---|---|---|
| node-sass | ≥ 3.3.0, < 4.13.1 | 4.13.1 |
Affected versions of node-sass are vulnerable to Denial of Service (DoS). Crafted objects passed to the renderSync function may trigger C++ assertions in CustomImporterBridge::get_importer_entry and CustomImporterBridge::post_process_return_value that crash the Node process. This may allow attackers to crash the system's running Node process and lead to Denial of Service.
Upgrade to version 4.13.1 or later
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free