CVE-2026-104844

npm/postcss-selector-parser CVE-2026-104844: medium 5.9

PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

Action: Upgrade postcss-selector-parser to 7.1.6 or later.

npm i postcss-selector-parser@7.1.6

Affected

Fixed versions

Sources

• osv: GHSA-rj75-hqrm-r3gf
• https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf
• https://nvd.nist.gov/vuln/detail/CVE-2026-104844
• https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd
• https://github.com/postcss/postcss-selector-parser
• https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6

CVE-2026-104844 · published 2026-10-05T22:53:54Z · modified 2026-10-05T23:00:05.308008424Z · JSON