StackRadar

CVE-2026-104844

Medium

Advisory

Published 5 Oct 2026In the index since 6 Oct 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.004
31st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
777
of 18,026 indexed, latest versions
Container images
781
deployed by those charts
Fix available
1 of 1
affected package

PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

Carried by container images the latest versions of 777 of 18,026 indexed charts deploy, on 781 images.

Affected packageAffected versionsFixed inImages
postcss-selector-parsernpm2.2.3, 3.1.1, 3.1.2, 5.0.0+21 more7.1.6781
OSV records
GHSA-rj75-hqrm-r3gf
Trending
Rank 22 in indexed charts, since 6 Oct 2026. See the ranking →

Charts affected

777 by stars
ChartLatestAffected imagesRadar Score
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

5,214
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

2,706
n8nvictorlane1.0.181 of 1See more

n8n victorlane 1.0.18

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
n8nio/n8n:1.115.1ed16e560c40e
postcss-selector-parser@7.1.0
7.1.6

Open the chart page →

7,503
video-dl-botvideo-dl-botVerified publisher1.4.31 of 1See more

video-dl-bot video-dl-bot 1.4.3

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/tarampampam/video-dl-bot:1.4.36daa2dc7556b
postcss-selector-parser@7.1.4
7.1.6

Open the chart page →

2,239
hedgedocvista0.1.11 of 1See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

3,473
vote-appvote-appVerified publisher1.0.71 of 6See more

vote-app vote-app 1.0.7

1 of the 6 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
thecloudspark/app-result:1.09a5302cb8312
postcss-selector-parser@6.0.16
7.1.6

Open the chart page →

3,217
resultappvoting-app-helm-charts-repoVerified publisher1.0.01 of 1See more

resultapp voting-app-helm-charts-repo 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

1,559
voteappvoting-app-helm-charts-repoVerified publisher1.0.01 of 5See more

voteapp voting-app-helm-charts-repo 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

9,766
resultappvoting-app-helm-charts-repo-cloudVerified publisher1.0.01 of 1See more

resultapp voting-app-helm-charts-repo-cloud 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

1,559
voteappvoting-app-helm-charts-repo-cloudVerified publisher1.0.01 of 5See more

voteapp voting-app-helm-charts-repo-cloud 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

9,766
voting-app-envvoting-example-with-env0.0.31 of 6See more

voting-app-env voting-example-with-env 0.0.3

1 of the 6 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
kerolosayman308/voting-app-env:examplevotingapp_result6e92e5a231fa
postcss-selector-parser@6.1.0
7.1.6

Open the chart page →

7,958
websitewaldo-visionVerified publisher0.33.02 of 2See more

website waldo-vision 0.33.0

2 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/waldo-vision/migrate:v0.3.6ae31923312ed
postcss-selector-parser@6.0.11
7.1.6
ghcr.io/waldo-vision/web:v0.3.65bbc7647df07
postcss-selector-parser@6.0.11
7.1.6

Open the chart page →

4,124
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
postcss-selector-parser@6.1.2
7.1.6

Open the chart page →

6,436
welcome-clientwelcome-client26.0.01 of 1See more

welcome-client welcome-client 26.0.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
lucassandin/welcome-client:latest48468b1ccd16
postcss-selector-parser@6.0.15
7.1.6

Open the chart page →

1,651
apisix-ingress-controllerwener1.4.01 of 2See more

apisix-ingress-controller wener 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/api7/adc:0.27.1f65f53dd9668
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

2,087
cadencewener0.23.01 of 5See more

cadence wener 0.23.0

1 of the 5 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ubercadence/web:v3.29.58564a5b44a6d
postcss-selector-parser@2.2.3
7.1.6

Open the chart page →

13,179
temporalwener0.15.11 of 13See more

temporal wener 0.15.1

1 of the 13 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
postcss-selector-parser@2.2.3
7.1.6

Open the chart page →

29,471
verdacciowener4.35.21 of 1See more

verdaccio wener 4.35.2

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
verdaccio/verdaccio:6.10.5560744912b64
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

327
wikiwener2.2.01 of 2See more

wiki wener 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
requarks/wiki:latestfffff288a52f
postcss-selector-parser@7.1.4
7.1.6

Open the chart page →

2,599
apisix-ingress-controllerwenerme1.4.01 of 2See more

apisix-ingress-controller wenerme 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/api7/adc:0.27.1f65f53dd9668
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

2,087
cadencewenerme0.23.01 of 5See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ubercadence/web:v3.29.58564a5b44a6d
postcss-selector-parser@2.2.3
7.1.6

Open the chart page →

13,179
temporalwenerme0.15.11 of 13See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
postcss-selector-parser@2.2.3
7.1.6

Open the chart page →

29,471
verdacciowenerme4.35.21 of 1See more

verdaccio wenerme 4.35.2

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
verdaccio/verdaccio:6.10.5560744912b64
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

327
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
requarks/wiki:2af71a17dc27c
postcss-selector-parser@7.1.4
7.1.6

Open the chart page →

4,321
playwright-synthetic-monitoringwork-adventure1.0.11 of 1See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
postcss-selector-parser@6.0.16
7.1.6

Open the chart page →

15,686
workadventure-adminwork-adventure1.0.0-21-34 of 14See more

workadventure-admin work-adventure 1.0.0-21-3

4 of the 14 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-back:helm-chart53a30c962ce9
postcss-selector-parser@6.0.13
7.1.6
thecodingmachine/workadventure-map-storage:helm-chart519c31c6e7ec
postcss-selector-parser@6.0.11
7.1.6
thecodingmachine/workadventure-play:helm-chartdf31006cc4ce
postcss-selector-parser@6.0.13
7.1.6
thecodingmachine/workadventure-uploader:helm-chart962e98843fb2
postcss-selector-parser@6.0.13
7.1.6

Open the chart page →

19,835
workadventureworkadventure1.1.04 of 9See more

workadventure workadventure 1.1.0

4 of the 9 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-back:v1.17.764001369dad5
postcss-selector-parser@6.0.10
7.1.6
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
postcss-selector-parser@6.0.10
7.1.6
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
postcss-selector-parser@6.0.10
7.1.6
thecodingmachine/workadventure-uploader:v1.17.73ccd467543b3
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

20,456

Container images carrying it

781 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
postcss-selector-parser@7.1.0
7.1.6
2
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
postcss-selector-parser@6.1.2
7.1.6
2
mojaloop/role-assignment-service:v2.1.0def4bf273721
postcss-selector-parser@6.0.13
7.1.6
2
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
postcss-selector-parser@7.1.0
7.1.6
2
moreillon/group-manager:v4.9.0d5a0ec8394c0
postcss-selector-parser@6.0.10
7.1.6
2
moreillon/user-manager:v5.0.2e1c9bfab5c16
postcss-selector-parser@6.0.13
7.1.6
2
n8nio/n8n:2.36.714c4285bc303
postcss-selector-parser@7.1.4
7.1.6
2
nodered/node-red:5.0.7:latesta649dd711d55
postcss-selector-parser@7.1.4
7.1.6
2
nousresearch/hermes-agent:v2026.9.24fca358f12efd
postcss-selector-parser@7.1.4
7.1.6
2
outlinewiki/outline:0.69.1d060dcd8f9aa
postcss-selector-parser@6.0.11
7.1.6
2
patrikx3/p3x-redis-ui:latestf19eb45b0694
postcss-selector-parser@7.1.4
7.1.6
2
rajnandan1/kener:3.2.1930407afca731
postcss-selector-parser@6.1.2
7.1.6
2
redis/redis-stack:7.2.0-v91c5f43fddcdd
postcss-selector-parser@6.0.13
7.1.6
2
requarks/wiki:latestfffff288a52f
postcss-selector-parser@7.1.4
7.1.6
2
shahanafarooqui/rtl:0.13.3e2195188a451
postcss-selector-parser@6.0.10
7.1.6
2
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
postcss-selector-parser@7.1.1
7.1.6
2
speckle/speckle-preview-service:2.18.11-branch.testing2.88634-335d469:2.18.12-branch.testing3.88744-f55b3414bd113093583
postcss-selector-parser@6.0.13
7.1.6
2
stakater/stakater-nordmart-review-ui:1.0.143f4926eedc74
postcss-selector-parser@6.0.6
7.1.6
2
sysnet4admin/dashboard:bluec5bd3bb1b5a6
postcss-selector-parser@6.1.0
7.1.6
2
taigaio/taiga-events:latest92fc0822564f
postcss-selector-parser@6.0.10
7.1.6
2
temporalio/web:1.14.033cfa863d8ce
postcss-selector-parser@2.2.3
7.1.6
2
ubercadence/web:v3.29.58564a5b44a6d
postcss-selector-parser@2.2.3
7.1.6
2
ghcr.io/advplyr/audiobookshelf:2.36.0180acad33d69
postcss-selector-parser@6.1.0
7.1.6
2
ghcr.io/advplyr/audiobookshelf:2.37.1581d68b2a6fc
postcss-selector-parser@7.1.4
7.1.6
2
ghcr.io/browserless/chromium:v2.57.06bac628b3d82
postcss-selector-parser@7.1.4
7.1.6
2
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
postcss-selector-parser@6.1.2
7.1.6
2
ghcr.io/codingducksrl/laravel:8.15be52524664c
postcss-selector-parser@6.0.10
7.1.6
2
ghcr.io/cross-seed/cross-seed:6.13.381afafdd96a5
postcss-selector-parser@6.1.0
7.1.6
2
ghcr.io/gethomepage/homepage:latest:v2.4.0643bd0be730d
postcss-selector-parser@7.1.1
7.1.6
2
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
postcss-selector-parser@6.1.4
7.1.6
2
ghcr.io/libredb/libredb-studio:0.18.0095a5ed5f7a1
postcss-selector-parser@7.1.4
7.1.6
2
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
postcss-selector-parser@6.0.10
7.1.6
2
ghcr.io/lissy93/web-check:latest7e2ef5261764
postcss-selector-parser@7.1.1
7.1.6
2
ghcr.io/nucleuscloud/neosync/app:0.5.41ca31ec35b829
postcss-selector-parser@6.1.2
7.1.6
2
ghcr.io/seerr-team/seerr:latest:v3.5.027602401178d
postcss-selector-parser@7.1.1
7.1.6
2
ghcr.io/techno-tim/littlelink-server:lateste84ea9d93b60
postcss-selector-parser@6.0.13
7.1.6
2
ghcr.io/wg-easy/wg-easy:15:15.4.00e7bc9d34e86
postcss-selector-parser@7.1.4
7.1.6
2
ghcr.io/wg-easy/wg-easy:145f26407fd2ed
postcss-selector-parser@6.1.2
7.1.6
2
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
postcss-selector-parser@6.0.10
7.1.6
2
0hlov3/semaphore:v1.0.050f874ec096b
postcss-selector-parser@6.0.10
7.1.6
1
aaronshaf/dynamodb-admin:latestac41724cd997
postcss-selector-parser@7.1.1
7.1.6
1
activepieces/activepieces:0.91.058414dfc94c4
postcss-selector-parser@7.1.1
7.1.6
1
activepieces/activepieces:0.28.0a12efde0c535
postcss-selector-parser@6.0.10
7.1.6
1
activepieces/activepieces:0.23.0c26188b44e62
postcss-selector-parser@6.0.10
7.1.6
1
actualbudget/actual-server:25.3.158fecd9088b7
postcss-selector-parser@6.1.0
7.1.6
1
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
postcss-selector-parser@7.1.0
7.1.6
1
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
postcss-selector-parser@6.1.2
7.1.6
1
agentarea/agentarea-frontend:latest56360a626a00
postcss-selector-parser@7.1.1
7.1.6
1
agentarea/agentarea-mcp-base:latestcd57c37971a0
postcss-selector-parser@7.1.1
7.1.6
1
agentarea/agentarea-mcp-runner:latest9030cc19a0fc
postcss-selector-parser@7.1.1
7.1.6
1

syft 1.42.1 · advisories as of 6 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.