CVE-2026-104844
MediumAdvisory
Published 5 Oct 2026In the index since 6 Oct 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.9
- base score, highest
- EPSS
- 0.004
- 31st percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 780
- of 18,035 indexed, latest versions
- Container images
- 784
- deployed by those charts
- Fix available
- 1 of 1
- affected package
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
Carried by container images the latest versions of 780 of 18,035 indexed charts deploy, on 784 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| postcss-selector-parsernpm | 2.2.3, 3.1.1, 3.1.2, 5.0.0+21 more | 7.1.6 | 784 |
- OSV records
- GHSA-rj75-hqrm-r3gf
- Trending
- Rank 4 in indexed charts, since 6 Oct 2026. See the ranking →
Charts affected
780 by stars
Container images carrying it
784 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 6197516c9d7b | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | ed07e7ca098d | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 51ee22428b41 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | c4cbd5121236 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | f4768de5f616 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | a0ec71732c3c | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 9665c3e71889 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 0dbc52cffc19 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | dfd7ea7303a2 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 6daa2dc7556b | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 735a1fcd078b | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 38eba84b2be8 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 4c6ac131e01c | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 7466b1c8367c | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 164f59b93e45 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | d5aa22a0ffe3 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 39a86744a7ba | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | b649f5ce2384 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 1d435b4ab372 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 28edefb6c92d | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 57a06bfba327 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 28f263fe06f7 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 60fa8875aff8 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 73ca19b41745 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | e3f80c0625aa | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 5bae30456ddb | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 05b05c56da94 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | ae31923312ed | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 5bbc7647df07 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | ff55992f905c | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 398c34934453 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 508505345eba | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 23a86c7a0b8a | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | bfc3118f6565 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | dbaa8527bf4c | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 0708d30433d4 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | d86fcf169f15 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 49800ff775f3 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 454f4384713a | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | 978cda40de67 | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | c27e20f7a2ca | postcss-selector-parser | 7.1.6 | 1 |
| ghcr.io/ | d7f76c9c65d9 | postcss-selector-parser | 7.1.6 | 1 |
| mcr.microsoft.com/ | 830430c1da1a | postcss-selector-parser | 7.1.6 | 1 |
| mcr.microsoft.com/ | e101b832b34d | postcss-selector-parser | 7.1.6 | 1 |
| public.ecr.aws/ | f1c5763d565e | postcss-selector-parser | 7.1.6 | 1 |
| public.ecr.aws/ | fea799d4fb2f | postcss-selector-parser | 7.1.6 | 1 |
| public.ecr.aws/ | a2057fabc948 | postcss-selector-parser | 7.1.6 | 1 |
| public.ecr.aws/ | 75a48d987e0f | postcss-selector-parser | 7.1.6 | 1 |
| public.ecr.aws/ | b1493760c716 | postcss-selector-parser | 7.1.6 | 1 |
| public.ecr.aws/ | 5cd62142d6ed | postcss-selector-parser | 7.1.6 | 1 |