Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104844— PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

Quick assessment

Affected
postcss postcss-selector-parser
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PostCSS Selector Parser 是一个 CSS 选择器解析器，它与 PostCSS 集成，但不依赖 PostCSS。在版本 7.1.6 之前，src/parser.js 中的 splitWord() 函数可能将一个平面选择器作为单个词元接收，该词元包含多个类（class）或 ID 索引，因为句点（.）和哈希（#）字符未被用作词元中的单词分隔符。uniqs() 去重函数以及按索引进行的类和 ID 成员资格检查会反复扫描类和 ID 索引数组，同时另一个用于过滤 Sass 插值的步骤也执行重复的线性扫描。

CVSS 5.9 · Medium EPSS 0.39% · P31

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking

Affected Version Matrix 1

VendorProduct Version RangeStatus
postcss postcss-selector-parser < 7.1.6 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104844

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
Source: CVE Program / CVE List V5
Vulnerability Description
PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The uniqs() deduplication and per-index class and ID membership checks repeatedly scan the class and ID index arrays, while a separate Sass-interpolation filtering pass also performs repeated linear scanning. Together, these passes make parsing quadratic in the number of indexes and allow a crafted selector to occupy a synchronous parser thread. The maxNestingDepth guard does not mitigate the issue because the hostile selector can have zero nesting depth. Only consumers that synchronously parse untrusted selectors in an exposed request path are affected; ordinary build-time parsing of trusted sources is not affected. This issue is fixed in version 7.1.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
postcss postcss-selector-parser < 7.1.6 -

II. Public POCs for CVE-2026-104844

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104844

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-104844 (1)

Vendor Advisories for CVE-2026-104844 (1)

Vendor Pages for CVE-2026-104844 (1)

IV. Related Vulnerabilities

Same product: postcss-selector-parser
Same vendor: postcss
Same weakness: CWE-400

V. Comments for CVE-2026-104844

No comments yet

Leave a comment