Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

postcss-selector-parser

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.9npmAmendedPublished

    PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

    CVE-2026-104844 · GHSA-rj75-hqrm-r3gf

    Affected
    • npm postcss-selector-parser >= 7.0.0, < 7.1.6; < 6.1.5
    Fixed in
    6.1.57.1.6· Vendor fix available
    Issue
    Impact `.` and `#` are not word delimiters in the tokenizer, so a flat selector such as `.a.a.a...` reaches `splitWord()` as a single word token carrying n class or id indexes. Three passes scanned those index arrays linearly for every index, making the parse O(n^2) in the number of indexes rather than in input length: `uniqs()`, the `indices.forEach` loop, and the Sass-interpolation filter. Parsing a 400 KB flat selector took ~34 s on a modern laptop, fully occupying a single thread. A benign selector of identical byte size parses in tens of milliseconds, so the cost is driven by the index count, not the input size. The nesting depth of such a selector is 0, so the `maxNestingDepth` guard added in 7.1.3 offers no protection. Reachability is deployment dependent. Only consumers that parse untrusted, attacker-supplied selectors synchronously in a request path are exposed, for example CSS sanitizers, CSS-in-JS services and online playgrounds. Ordinary build-time use on trusted…

    Recommended action: Upgrade to 7.1.6 or 6.1.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →
  2. Low, CVSS 2.1npmAmendedPublished

    postcss-selector-parser allows denial of service through uncontrolled AST recursion

    CVE-2026-9358 · GHSA-w9m9-85wc-3x92

    Affected
    • npm postcss-selector-parser >= 6.1.0, < 6.1.3; >= 7.1.0, < 7.1.3
    Fixed in
    6.1.37.1.3· Vendor fix available
    Issue
    A vulnerability was determined in postcss-selector-parser before 6.1.3 and 7.1.1. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains, that according to his definition "DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS)."

    Recommended action: Upgrade to 7.1.3 or 6.1.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →