CVE-2026-104844: PostCSS Selector Parser CPU Exhaustion Vulnerability
Summary
CVE-2026-104844: PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion. Affects postcss-selector-parser versions < 7.1.6. Fixed in 7.1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostCSS Selector Parser is a widely used npm package that allows developers to parse and manipulate CSS selectors. It is essential for tools that require CSS processing, such as CSS-in-JS libraries and CSS sanitizers. The package is designed to handle various CSS selector formats efficiently, but it has a vulnerability that can lead to performance issues when parsing certain types of selectors.
Vulnerability Detail
The vulnerability arises from the way the PostCSS Selector Parser handles flat selectors containing multiple class or ID indexes. Specifically, the tokenizer does not treat . and # as word delimiters, resulting in a single word token that carries numerous indexes. This leads to a quadratic complexity in parsing, making the operation O(n^2) in terms of the number of indexes. As a result, parsing a large flat selector can cause significant CPU exhaustion, taking an excessive amount of time to complete. This issue primarily affects consumers that parse untrusted, attacker-supplied selectors synchronously, such as CSS sanitizers and online playgrounds.
How To Fix
Latest published version: 7.1.7 as of 23 Oct 2026
npm install postcss-selector-parser@7.1.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.1.6
This is the first release that contains the fix.
npm install postcss-selector-parser@7.1.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can cap the size of selectors accepted from untrusted sources before parsing. This can be implemented in your code as follows:
const MAX_SELECTOR_LENGTH = 100; // Set a maximum length for selectors
function parseSelector(selector) {
if (selector.length > MAX_SELECTOR_LENGTH) {
throw new Error('Selector too long');
}
return postcssSelectorParser.parse(selector);
}
Conclusion
The CVE-2026-104844 vulnerability in the PostCSS Selector Parser poses a risk of CPU exhaustion due to inefficient parsing of flat selectors. It is crucial for developers to update to version 7.1.6 or later to mitigate this risk. Additionally, implementing a size cap for untrusted selectors can serve as a temporary workaround.
See every vulnerability recorded for postcss-selector-parser →
FAQ
CVE-2026-104844 is a vulnerability in the PostCSS Selector Parser that can lead to CPU exhaustion due to inefficient parsing of flat selectors with multiple indexes.
If your application parses untrusted CSS selectors synchronously, it may be susceptible to this vulnerability, leading to performance degradation or denial of service.
Versions prior to 7.1.6 are affected by this vulnerability. It is recommended to upgrade to version 7.1.6 or later.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 5.9, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for postcss-selector-parser.
