CVE-2026-104844

PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

Published Oct 2, 2026 CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Description

PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The uniqs() deduplication and per-index class and ID membership checks repeatedly scan the class and ID index arrays, while a separate Sass-interpolation filtering pass also performs repeated linear scanning. Together, these passes make parsing quadratic in the number of indexes and allow a crafted selector to occupy a synchronous parser thread. The maxNestingDepth guard does not mitigate the issue because the hostile selector can have zero nesting depth. Only consumers that synchronously parse untrusted selectors in an exposed request path are affected; ordinary build-time parsing of trusted sources is not affected. This issue is fixed in version 7.1.6.

Analysis

Technical impact

The vulnerability in PostCSS Selector Parser introduces quadratic time complexity during parsing of flat CSS selectors, a flaw that is an instance of resource exhaustion (CWE-400), inefficient algorithm design (CWE-407), and uncontrolled input handling (CWE-606). A crafted selector can cause the parser thread to consume excessive CPU, leading to denial of service for applications that parse untrusted selectors synchronously.

Affected Systems

All versions of postcss-selector-parser prior to 7.1.6 are affected; the flaw impacts consumers that synchronously parse user‑supplied selectors in request paths, while build‑time or trusted parsing scenarios are not affected.

Risk and Exploitability

With a CVSS score of 5.9 the vulnerability is rated medium, EPSS data is unavailable, and it is not listed in the CISA KEV; exploitation requires delivering a malicious selector through an exposed request path and can degrade performance without compromising data integrity.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

postcss

postcss-selector-parser

affected

Version	Status	Constraints
`< 7.1.6`	affected	—

No data.

Vendor Product Versions

Postcss

Postcss-selector-parser

Version	Status	Scheme	Platform
`[0,7.1.6)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade postcss-selector-parser to version 7.1.6 or later.
Ensure that all parsing of user‑supplied selectors occurs in an isolated or asynchronous context, or remove such parsing from critical request paths.
If upgrading is not immediately possible, restrict the size or format of selectors accepted, or sandbox the parser with CPU limits.

Generated by OpenCVE AI on October 3, 2026 at 02:21 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-rj75-hqrm-r3gf	PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.389% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd
https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6
https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf
https://nvd.nist.gov/vuln/detail/CVE-2026-104844
https://www.cve.org/CVERecord?id=CVE-2026-104844

History

Oct 4, 2026 10:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Postcss Postcss postcss-selector-parser
Vendors & Products		Postcss Postcss postcss-selector-parser

Oct 3, 2026 12:30 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-606
References		https://nvd.nist.gov/vuln/detail/CVE-2026-104844 https://www.cve.org/CVERecord?id=CVE-2026-104844
Metrics	threat_severity `None`	threat_severity `Moderate`

Oct 2, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 2, 2026 4:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The uniqs() deduplication and per-index class and ID membership checks repeatedly scan the class and ID index arrays, while a separate Sass-interpolation filtering pass also performs repeated linear scanning. Together, these passes make parsing quadratic in the number of indexes and allow a crafted selector to occupy a synchronous parser thread. The maxNestingDepth guard does not mitigate the issue because the hostile selector can have zero nesting depth. Only consumers that synchronously parse untrusted selectors in an exposed request path are affected; ordinary build-time parsing of trusted sources is not affected. This issue is fixed in version 7.1.6.
Title		PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
Weaknesses		CWE-400 CWE-407
References		https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6 https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf
Metrics		cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`