npm/postcss-selector-parser CVE-2026-9358: medium 4.3, EPSS 0.58%
postcss-selector-parser allows denial of service through uncontrolled AST recursion
Action: Upgrade postcss-selector-parser to 6.1.3 or later.
npm i postcss-selector-parser@6.1.3npm i postcss-selector-parser@7.1.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.1.0 | 6.1.3 | - |
| 7.1.0 | 7.1.3 | - |
Fixed versions
| 6.1.3 | 7.1.3 |
Sources
- osv: GHSA-w9m9-85wc-3x92
- https://nvd.nist.gov/vuln/detail/CVE-2026-9358
- https://github.com/postcss/postcss-selector-parser/commit/5bc698cef66f8abd12610dc623e5d67cbc0f869d
- https://github.com/postcss/postcss-selector-parser/commit/e37c5b0b785b165e27508d2489fdec8e0f18b10a
- https://gist.github.com/bx33661/581e3a38134601c04e19b4dfc9b459b9
- https://github.com/postcss/postcss-selector-parser
- https://github.com/postcss/postcss-selector-parser/releases/tag/6.1.3
- https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.3
- https://vuldb.com/cve/CVE-2026-9358
- https://vuldb.com/submit/813080
- https://vuldb.com/vuln/365321
- https://vuldb.com/vuln/365321/cti
CVE-2026-9358 · published · modified · JSON