StackRadar

CVE-2026-104844

Medium

Advisory

Published 5 Oct 2026In the index since 6 Oct 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.004
31st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
761
of 18,035 indexed, latest versions
Container images
762
deployed by those charts
Fix available
1 of 1
affected package

PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

Carried by container images the latest versions of 761 of 18,035 indexed charts deploy, on 762 images.

Affected packageAffected versionsFixed inImages
postcss-selector-parsernpm2.2.3, 3.1.1, 3.1.2, 5.0.0+21 more7.1.6762
OSV records
GHSA-rj75-hqrm-r3gf
Trending
Rank 22 in indexed charts, since 6 Oct 2026. See the ranking →

Charts affected

761 by stars
ChartLatestAffected imagesRadar Score
authfcryptexlabsVerified publisher0.12.131 of 4See more

authf cryptexlabs 0.12.13

1 of the 4 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
cryptexlabs/authf:0.12.11189c07411d7c
postcss-selector-parser@6.0.13
7.1.6

Open the chart page →

4,127
swagger-combine-uicryptexlabsVerified publisher0.2.41 of 1See more

swagger-combine-ui cryptexlabs 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
cryptexlabs/swagger-combine-ui:0.2.1ed0bc94fd412
postcss-selector-parser@6.0.13
7.1.6

Open the chart page →

1,455
cspconsolecspconsole1.3.111 of 5See more

cspconsole cspconsole 1.3.11

1 of the 5 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
cspconsole/report-processor:1.0.279a2d8840bfdf
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

13,517
myawesomeappcuriousgeekshelmfirstapp0.1.21 of 1See more

myawesomeapp curiousgeekshelmfirstapp 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
srini78/nodejswebappeks:latest5d1cbdc6833a
postcss-selector-parser@6.0.11
7.1.6

Open the chart page →

1,369
kuberay-dashboarddanchevVerified publisher0.0.51 of 1See more

kuberay-dashboard danchev 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
quay.io/kuberay/dashboard:v1.7.07e43d4b4fd9f
postcss-selector-parser@7.1.4
7.1.6

Open the chart page →

697
dapr-agentsdapr-agents-devVerified publisher0.1.51 of 31See more

dapr-agents dapr-agents-dev 0.1.5

1 of the 31 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
redis/redisinsight:latestb5e19ee240ab
postcss-selector-parser@7.1.0
7.1.6

Open the chart page →

28,191
datacube-wpsdatacube-charts0.9.01 of 1See more

datacube-wps datacube-charts 0.9.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
opendatacube/wps:latest80df355a660b
postcss-selector-parser@6.1.2
7.1.6

Open the chart page →

6,842
dbgatedbgate-helm-chartVerified publisher0.1.81 of 1See more

dbgate dbgate-helm-chart 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
dbgate/dbgate:7.2.3f2dc7423ea88
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

1,841
decisionrules-aksdecisionrules-aksVerified publisher0.3.01 of 2See more

decisionrules-aks decisionrules-aks 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
decisionrules/server:latestbb3a93224b5a
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

458
decisionrules-eksdecisionrules-eksVerified publisher0.4.01 of 2See more

decisionrules-eks decisionrules-eks 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
decisionrules/server:latestbb3a93224b5a
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

458
decisionrules-ingressdecisionrules-ingressVerified publisher0.3.01 of 2See more

decisionrules-ingress decisionrules-ingress 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
decisionrules/server:latestbb3a93224b5a
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

458
decisionrules-ocpdecisionrules-ocpVerified publisher0.2.02 of 4See more

decisionrules-ocp decisionrules-ocp 0.2.0

2 of the 4 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
decisionrules/business-intelligence:latest7c410e0c1d7b
postcss-selector-parser@7.1.1
7.1.6
decisionrules/server:latestbb3a93224b5a
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

1,506
defactopsdefactops1.0.91 of 2See more

defactops defactops 1.0.9

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
defactops/defactops-backend:1.0.2307b663c0092a
postcss-selector-parser@6.0.15
7.1.6

Open the chart page →

5,275
airtraildefault-ghVerified publisher0.2.21 of 2See more

airtrail default-gh 0.2.2

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
johly/airtrail:v3.11.19f702b91e0e7
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

1,955
homarrdelerVerified publisher1.0.11 of 1See more

homarr deler 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:0.13.4985456bdfb46
postcss-selector-parser@6.0.13
7.1.6

Open the chart page →

2,059
deploy-elibrarydeploy-elibrary-helm0.1.01 of 1See more

deploy-elibrary deploy-elibrary-helm 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
psorab/elibrary:latest53b68896c4ce
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

7,701
deploy-elibrarydeploy-elibrary-oo0.1.01 of 1See more

deploy-elibrary deploy-elibrary-oo 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
jedi132000/nextapp:latestdc2a81e92f23
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

8,600
desishowbiz-frontenddesishowbiz1.0.01 of 1See more

desishowbiz-frontend desishowbiz 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
rahulbhiwagade122/desishowbiz:latest08490b70998c
postcss-selector-parser@6.1.0
7.1.6

Open the chart page →

2,970
backend-servicedev-krishan-dhaka-charts1.0.31 of 1See more

backend-service dev-krishan-dhaka-charts 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
devkrishan001/backend:latestf1c3acadeabe
postcss-selector-parser@6.1.0
7.1.6

Open the chart page →

1,406
apachedevops0.1.01 of 4See more

apache devops 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/codingducksrl/laravel:8.15be52524664c
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

121,425
laraveldevops0.10.31 of 4See more

laravel devops 0.10.3

1 of the 4 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/codingducksrl/laravel:8.15be52524664c
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

120,436
devtron-enterprisedevtron48.0.01 of 28See more

devtron-enterprise devtron 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
postcss-selector-parser@7.1.0
7.1.6

Open the chart page →

84,429
devtron-enterprisedevtron-labs48.0.01 of 28See more

devtron-enterprise devtron-labs 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
postcss-selector-parser@7.1.0
7.1.6

Open the chart page →

84,429
dial-admindialVerified publisher0.19.01 of 3See more

dial-admin dial 0.19.0

1 of the 3 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
epam/ai-dial-admin-frontend:0.21.01ecee9f1aa09
postcss-selector-parser@7.1.4
7.1.6

Open the chart page →

4,169
difydify1.0.02 of 4See more

dify dify 1.0.0

2 of the 4 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
langgenius/dify-sandbox:0.2.009b7e8705673
postcss-selector-parser@6.0.13
7.1.6
langgenius/dify-web:1.0.0d64914ff0d6d
postcss-selector-parser@6.1.0
7.1.6

Open the chart page →

56,689
directusdirectusVerified publisher0.9.101 of 4See more

directus directus 0.9.10

1 of the 4 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
directus/directus:11.1.0e3c8bb975350
postcss-selector-parser@6.1.1
7.1.6

Open the chart page →

5,437
disk-resizer-controllerdisk-resizer-controller0.0.0-3fa07c21 of 1See more

disk-resizer-controller disk-resizer-controller 0.0.0-3fa07c2

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
cubos/disk-resizer-controller:0.0.0-3fa07c2b0c4a82d13c2
postcss-selector-parser@6.0.13
7.1.6

Open the chart page →

1,362
node-reddjdl-charts0.33.01 of 1See more

node-red djdl-charts 0.33.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
nodered/node-red:latesta649dd711d55
postcss-selector-parser@7.1.4
7.1.6

Open the chart page →

512
adventurelogdjjudas21Verified publisher0.1.11 of 3See more

adventurelog djjudas21 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/seanmorley15/adventurelog-frontend:v0.13.051ee22428b41
postcss-selector-parser@7.1.4
7.1.6

Open the chart page →

9,633
uptime-kumadjjudas21Verified publisher1.5.181 of 1See more

uptime-kuma djjudas21 1.5.18

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.12bc6f244ecf27
postcss-selector-parser@6.0.15
7.1.6

Open the chart page →

5,270
documensodocumensoVerified publisher0.0.61 of 2See more

documenso documenso 0.0.6

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
documenso/documenso:v1.8.17f16a9449f18
postcss-selector-parser@6.1.0
7.1.6

Open the chart page →

3,227
dumpstoredumpstore0.1.12 of 2See more

dumpstore dumpstore 0.1.1

2 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
postcss-selector-parser@6.1.0
7.1.6
ghcr.io/manzil-infinity180/frontend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b44e6394b715d9
postcss-selector-parser@6.1.0
7.1.6

Open the chart page →

5,081
amundsenduyet1.1.01 of 7See more

amundsen duyet 1.1.0

1 of the 7 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
amundsendev/amundsen-frontend:2.1.169e7915e61c1
postcss-selector-parser@6.0.2
7.1.6

Open the chart page →

12,954
clickhouse-monitoringduyet0.1.31 of 2See more

clickhouse-monitoring duyet 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/duyet/clickhouse-monitoring:latest84edfe8a67a8
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

1,196
benchmarking-tooleclipse-aeriosVerified publisher1.0.01 of 1See more

benchmarking-tool eclipse-aerios 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
eclipseaerios/benchmarking-tool:1.0.0a4b4c2e7fe62
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

887
self-orchestratoreclipse-aeriosVerified publisher1.2.01 of 1See more

self-orchestrator eclipse-aerios 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
eclipseaerios/self-orchestrator:1.2.08b123bec5679
postcss-selector-parser@6.1.2
7.1.6

Open the chart page →

2,761
dashboardedu1.0.01 of 1See more

dashboard edu 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
sysnet4admin/dashboard:bluec5bd3bb1b5a6
postcss-selector-parser@6.1.0
7.1.6

Open the chart page →

1,671
deploy-elibraryeducative-helm-bookapp0.5.01 of 1See more

deploy-elibrary educative-helm-bookapp 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
maksymhencha/educative-helm-bookapp:0.0.27f096a681192
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

5,465
node-redegebackVerified publisher2.0.131 of 1See more

node-red egeback 2.0.13

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
nodered/node-red:5.0.410f40d0a83e7
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

1,491
uptime-kumaegebackVerified publisher2.0.121 of 1See more

uptime-kuma egeback 2.0.12

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.0a8610b3b4c38
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

34,165
frontend-charteks-3-tier-app-chart0.1.01 of 1See more

frontend-chart eks-3-tier-app-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
arfath29/3-tier-app-frontend:latest384b3e377f47
postcss-selector-parser@3.1.2
7.1.6

Open the chart page →

4,324
elk-stackelk-stack-test1.0.21 of 9See more

elk-stack elk-stack-test 1.0.2

1 of the 9 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
library/node:18-alpine8d6421d663b4
postcss-selector-parser@6.1.0
7.1.6

Open the chart page →

3,870
azuriteemberstackVerified publisher1.0.221 of 1See more

azurite emberstack 1.0.22

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
mcr.microsoft.com/azure-storage/azurite:latest830430c1da1a
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

680
reddarkemmas-chartsVerified publisher0.0.21 of 1See more

reddark emmas-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/0xemma/reddark:main2a115e991894
postcss-selector-parser@6.0.13
7.1.6

Open the chart page →

2,868
edp-installepmdedpOfficialVerified publisher3.15.01 of 7See more

edp-install epmdedp 3.15.0

1 of the 7 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
epamedp/krci-portal:0.8.0687acf641097
postcss-selector-parser@6.0.16
7.1.6

Open the chart page →

2,741
krci-portalepmdedpVerified publisher0.8.01 of 1See more

krci-portal epmdedp 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
epamedp/krci-portal:0.8.0687acf641097
postcss-selector-parser@6.0.16
7.1.6

Open the chart page →

1,036
hedgedocernail-hedgedoc5.0.01 of 1See more

hedgedoc ernail-hedgedoc 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

2,147
assertoorethereum-helm-chartsVerified publisher1.2.01 of 1See more

assertoor ethereum-helm-charts 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ethpandaops/assertoor:latest1efa2fba6711
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

3,294
blockscoutethereum-helm-chartsVerified publisher0.2.31 of 2See more

blockscout ethereum-helm-charts 0.2.3

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
blockscout/blockscout:5.1.5c365a8f2dc12
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

1,993
lodestarethereum-helm-chartsVerified publisher1.2.21 of 2See more

lodestar ethereum-helm-charts 1.2.2

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
chainsafe/lodestar:latestc13eac6aada7
postcss-selector-parser@7.1.4
7.1.6

Open the chart page →

3,164

Container images carrying it

762 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/wi_stefan/consent-manager:0.0.656399619568b
postcss-selector-parser@7.1.1
7.1.6
1
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
postcss-selector-parser@6.1.2
7.1.6
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
postcss-selector-parser@7.1.1
7.1.6
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
postcss-selector-parser@7.1.1
7.1.6
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
postcss-selector-parser@7.1.1
7.1.6
1
registry.gitlab.com/evolves-fr/s3-browser:0.4.1c350c941fe7b
postcss-selector-parser@7.1.1
7.1.6
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-api-gateway:prodf8474a665b11
postcss-selector-parser@7.1.4
7.1.6
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-events:prod764ca253f951
postcss-selector-parser@7.1.4
7.1.6
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-runtime:prodbdb1bcedf26f
postcss-selector-parser@7.1.4
7.1.6
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-workspaces:prode64a1cb3aa42
postcss-selector-parser@7.1.4
7.1.6
1
registry.gitlab.com/xrow-public/ci-tools/tools:mainaa62b23f2b5e
postcss-selector-parser@7.1.1
7.1.6
1
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
postcss-selector-parser@6.1.0
7.1.6
1

syft 1.42.1 · advisories as of 6 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.