Description
PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The uniqs() deduplication and per-index class and ID membership checks repeatedly scan the class and ID index arrays, while a separate Sass-interpolation filtering pass also performs repeated linear scanning. Together, these passes make parsing quadratic in the number of indexes and allow a crafted selector to occupy a synchronous parser thread. The maxNestingDepth guard does not mitigate the issue because the hostile selector can have zero nesting depth. Only consumers that synchronously parse untrusted selectors in an exposed request path are affected; ordinary build-time parsing of trusted sources is not affected. This issue is fixed in version 7.1.6.
Published: 2026-10-02
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via CPU exhaustion
Action: Apply Update
AI Analysis

Impact

The vulnerability in PostCSS Selector Parser introduces quadratic time complexity during parsing of flat CSS selectors, a flaw that is an instance of resource exhaustion (CWE-400), inefficient algorithm design (CWE-407), and uncontrolled input handling (CWE-606). A crafted selector can cause the parser thread to consume excessive CPU, leading to denial of service for applications that parse untrusted selectors synchronously.

Affected Systems

All versions of postcss-selector-parser prior to 7.1.6 are affected; the flaw impacts consumers that synchronously parse user‑supplied selectors in request paths, while build‑time or trusted parsing scenarios are not affected.

Risk and Exploitability

With a CVSS score of 5.9 the vulnerability is rated medium, EPSS data is unavailable, and it is not listed in the CISA KEV; exploitation requires delivering a malicious selector through an exposed request path and can degrade performance without compromising data integrity.

Generated by OpenCVE AI on October 3, 2026 at 02:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade postcss-selector-parser to version 7.1.6 or later.
  • Ensure that all parsing of user‑supplied selectors occurs in an isolated or asynchronous context, or remove such parsing from critical request paths.
  • If upgrading is not immediately possible, restrict the size or format of selectors accepted, or sandbox the parser with CPU limits.

Generated by OpenCVE AI on October 3, 2026 at 02:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-rj75-hqrm-r3gf PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
History

Sun, 04 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Postcss
Postcss postcss-selector-parser
Vendors & Products Postcss
Postcss postcss-selector-parser

Sat, 03 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-606
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 02 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 02 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The uniqs() deduplication and per-index class and ID membership checks repeatedly scan the class and ID index arrays, while a separate Sass-interpolation filtering pass also performs repeated linear scanning. Together, these passes make parsing quadratic in the number of indexes and allow a crafted selector to occupy a synchronous parser thread. The maxNestingDepth guard does not mitigate the issue because the hostile selector can have zero nesting depth. Only consumers that synchronously parse untrusted selectors in an exposed request path are affected; ordinary build-time parsing of trusted sources is not affected. This issue is fixed in version 7.1.6.
Title PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
Weaknesses CWE-400
CWE-407
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Postcss Postcss-selector-parser
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-02T16:16:45.990Z

Reserved: 2026-10-02T14:38:43.243Z

Link: CVE-2026-104844

cve-icon Vulnrichment

Updated: 2026-10-02T16:16:32.699Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-02T16:16:46.917

Modified: 2026-10-02T18:44:11.270

Link: CVE-2026-104844

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-02T15:43:14Z

Links: CVE-2026-104844 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-04T20:53:48Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-407

    Inefficient Algorithmic Complexity

  • CWE-606

    Unchecked Input for Loop Condition