StackRadar

CVE-2026-104844

Medium

Advisory

Published 5 Oct 2026In the index since 6 Oct 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.004
31st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
780
of 18,035 indexed, latest versions
Container images
784
deployed by those charts
Fix available
1 of 1
affected package

PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

Carried by container images the latest versions of 780 of 18,035 indexed charts deploy, on 784 images.

Affected packageAffected versionsFixed inImages
postcss-selector-parsernpm2.2.3, 3.1.1, 3.1.2, 5.0.0+21 more7.1.6784
OSV records
GHSA-rj75-hqrm-r3gf
Trending
Rank 4 in indexed charts, since 6 Oct 2026. See the ranking →

Charts affected

780 by stars
ChartLatestAffected imagesRadar Score
skoonervhdirkVerified publisher0.1.41 of 1See more

skooner vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

1,440
tdarrvhdirkVerified publisher5.0.51 of 2See more

tdarr vhdirk 5.0.5

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
haveagitgat/tdarr_node:2.17.013ff0913202dd
postcss-selector-parser@6.0.13
7.1.6

Open the chart page →

161,228
unmanicvhdirkVerified publisher0.1.41 of 1See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
josh5/unmanic:0.2.64d49c4816260
postcss-selector-parser@6.0.13
7.1.6

Open the chart page →

80,027
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

5,243
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

2,758
n8nvictorlane1.0.181 of 1See more

n8n victorlane 1.0.18

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
n8nio/n8n:1.115.1ed16e560c40e
postcss-selector-parser@7.1.0
7.1.6

Open the chart page →

7,534
video-dl-botvideo-dl-botVerified publisher1.4.31 of 1See more

video-dl-bot video-dl-bot 1.4.3

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/tarampampam/video-dl-bot:1.4.36daa2dc7556b
postcss-selector-parser@7.1.4
7.1.6

Open the chart page →

2,241
hedgedocvista0.1.11 of 1See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

3,476
vote-appvote-appVerified publisher1.0.71 of 6See more

vote-app vote-app 1.0.7

1 of the 6 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
thecloudspark/app-result:1.09a5302cb8312
postcss-selector-parser@6.0.16
7.1.6

Open the chart page →

3,215
resultappvoting-app-helm-charts-repoVerified publisher1.0.01 of 1See more

resultapp voting-app-helm-charts-repo 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

1,556
voteappvoting-app-helm-charts-repoVerified publisher1.0.01 of 5See more

voteapp voting-app-helm-charts-repo 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

9,529
resultappvoting-app-helm-charts-repo-cloudVerified publisher1.0.01 of 1See more

resultapp voting-app-helm-charts-repo-cloud 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

1,556
voteappvoting-app-helm-charts-repo-cloudVerified publisher1.0.01 of 5See more

voteapp voting-app-helm-charts-repo-cloud 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

9,529
voting-app-envvoting-example-with-env0.0.31 of 6See more

voting-app-env voting-example-with-env 0.0.3

1 of the 6 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
kerolosayman308/voting-app-env:examplevotingapp_result6e92e5a231fa
postcss-selector-parser@6.1.0
7.1.6

Open the chart page →

7,986
websitewaldo-visionVerified publisher0.33.02 of 2See more

website waldo-vision 0.33.0

2 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/waldo-vision/migrate:v0.3.6ae31923312ed
postcss-selector-parser@6.0.11
7.1.6
ghcr.io/waldo-vision/web:v0.3.65bbc7647df07
postcss-selector-parser@6.0.11
7.1.6

Open the chart page →

4,128
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
postcss-selector-parser@6.1.2
7.1.6

Open the chart page →

6,435
welcome-clientwelcome-client26.0.01 of 1See more

welcome-client welcome-client 26.0.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
lucassandin/welcome-client:latest48468b1ccd16
postcss-selector-parser@6.0.15
7.1.6

Open the chart page →

1,657
apisix-ingress-controllerwener1.4.01 of 2See more

apisix-ingress-controller wener 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/api7/adc:0.27.1f65f53dd9668
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

2,085
cadencewener0.23.01 of 5See more

cadence wener 0.23.0

1 of the 5 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ubercadence/web:v3.29.58564a5b44a6d
postcss-selector-parser@2.2.3
7.1.6

Open the chart page →

13,185
temporalwener0.15.11 of 13See more

temporal wener 0.15.1

1 of the 13 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
postcss-selector-parser@2.2.3
7.1.6

Open the chart page →

29,477
verdacciowener4.35.21 of 1See more

verdaccio wener 4.35.2

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
verdaccio/verdaccio:6.10.5560744912b64
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

340
wikiwener2.2.01 of 2See more

wiki wener 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
requarks/wiki:latestfffff288a52f
postcss-selector-parser@7.1.4
7.1.6

Open the chart page →

2,618
apisix-ingress-controllerwenerme1.4.01 of 2See more

apisix-ingress-controller wenerme 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/api7/adc:0.27.1f65f53dd9668
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

2,085
cadencewenerme0.23.01 of 5See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ubercadence/web:v3.29.58564a5b44a6d
postcss-selector-parser@2.2.3
7.1.6

Open the chart page →

13,185
temporalwenerme0.15.11 of 13See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
postcss-selector-parser@2.2.3
7.1.6

Open the chart page →

29,477
verdacciowenerme4.35.21 of 1See more

verdaccio wenerme 4.35.2

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
verdaccio/verdaccio:6.10.5560744912b64
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

340
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
requarks/wiki:2af71a17dc27c
postcss-selector-parser@7.1.4
7.1.6

Open the chart page →

4,340
playwright-synthetic-monitoringwork-adventure1.0.11 of 1See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
postcss-selector-parser@6.0.16
7.1.6

Open the chart page →

15,715
workadventure-adminwork-adventure1.0.0-21-34 of 14See more

workadventure-admin work-adventure 1.0.0-21-3

4 of the 14 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-back:helm-chart53a30c962ce9
postcss-selector-parser@6.0.13
7.1.6
thecodingmachine/workadventure-map-storage:helm-chart519c31c6e7ec
postcss-selector-parser@6.0.11
7.1.6
thecodingmachine/workadventure-play:helm-chartdf31006cc4ce
postcss-selector-parser@6.0.13
7.1.6
thecodingmachine/workadventure-uploader:helm-chart962e98843fb2
postcss-selector-parser@6.0.13
7.1.6

Open the chart page →

19,828
workadventureworkadventure1.1.04 of 9See more

workadventure workadventure 1.1.0

4 of the 9 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-back:v1.17.764001369dad5
postcss-selector-parser@6.0.10
7.1.6
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
postcss-selector-parser@6.0.10
7.1.6
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
postcss-selector-parser@6.0.10
7.1.6
thecodingmachine/workadventure-uploader:v1.17.73ccd467543b3
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

20,446

Container images carrying it

784 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
public.ecr.aws/jtekt-corporation/time-series-storage-service:v1.5.1046ef5c9ed50
postcss-selector-parser@6.0.13
7.1.6
1
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
postcss-selector-parser@6.0.13
7.1.6
1
quay.io/ai-lab/llamacpp_python:latest70d138997acd
postcss-selector-parser@6.1.0
7.1.6
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
postcss-selector-parser@6.0.6
7.1.6
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
postcss-selector-parser@7.1.1
7.1.6
1
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
postcss-selector-parser@3.1.1
7.1.6
1
quay.io/k3rnel-pan1c/uptime-kuma:1.19.3f975fde9329b
postcss-selector-parser@6.0.10
7.1.6
1
quay.io/kuberay/dashboard:v1.7.07e43d4b4fd9f
postcss-selector-parser@7.1.4
7.1.6
1
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
postcss-selector-parser@7.1.1
7.1.6
1
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
postcss-selector-parser@7.1.1
7.1.6
1
quay.io/mittwald/kube-mail:latest04f1099241fc
postcss-selector-parser@6.1.0
7.1.6
1
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
postcss-selector-parser@5.0.0
7.1.6
1
quay.io/netwarps/walletconnect-relay:v2.1.3-rc.15d90b9c193e0
postcss-selector-parser@6.0.10
7.1.6
1
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
postcss-selector-parser@6.0.15
7.1.6
1
quay.io/rhdh/rhdh-hub-rhel9:latest4f8c0f8a8ee0
postcss-selector-parser@7.1.4
7.1.6
1
quay.io/seamware/fdsc-dashboard:0.6.63478af70bdc2
postcss-selector-parser@6.1.0
7.1.6
1
quay.io/seamware/onboarding:0.2.2b406475f9f00
postcss-selector-parser@7.1.1
7.1.6
1
quay.io/soketi/k8soketi:0.1-18-debian4cd9ea9434c4
postcss-selector-parser@6.0.10
7.1.6
1
quay.io/soketi/soketi:1.6-16-debian713223456cf1
postcss-selector-parser@6.0.10
7.1.6
1
quay.io/wekan/wekan:v5.65cb17600883a3
postcss-selector-parser@3.1.2
7.1.6
1
quay.io/wi_stefan/consent-manager:0.0.656399619568b
postcss-selector-parser@7.1.1
7.1.6
1
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
postcss-selector-parser@6.1.2
7.1.6
1
registry.gitlab.com/dyff/dyff-frontend:0.21.06418c3c0d24a
postcss-selector-parser@6.1.0
7.1.6
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
postcss-selector-parser@7.1.1
7.1.6
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
postcss-selector-parser@7.1.1
7.1.6
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
postcss-selector-parser@7.1.1
7.1.6
1
registry.gitlab.com/evolves-fr/s3-browser:0.4.1c350c941fe7b
postcss-selector-parser@7.1.1
7.1.6
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-api-gateway:prodf8474a665b11
postcss-selector-parser@7.1.4
7.1.6
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-events:prod764ca253f951
postcss-selector-parser@7.1.4
7.1.6
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-runtime:prodbdb1bcedf26f
postcss-selector-parser@7.1.4
7.1.6
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-workspaces:prode64a1cb3aa42
postcss-selector-parser@7.1.4
7.1.6
1
registry.gitlab.com/xrow-public/ci-tools/tools:mainaa62b23f2b5e
postcss-selector-parser@7.1.1
7.1.6
1
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
postcss-selector-parser@6.1.0
7.1.6
1
registry.gitlab.com/xrow-public/helm-openclaw/openclaw:1.105.13f87eebbba88
postcss-selector-parser@7.1.4
7.1.6
1

syft 1.42.1 · advisories as of 7 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.