CVE-2026-104844

Medium

Advisory

Published 5 Oct 2026In the index since 6 Oct 2026

Severity: Medium; worst across findings
CVSS: 5.9; base score, highest
EPSS: 0.004; 31st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 767; of 18,035 indexed, latest versions
Container images: 768; deployed by those charts
Fix available: 1 of 1; affected package

PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

Carried by container images the latest versions of 767 of 18,035 indexed charts deploy, on 768 images.

Affected package	Affected versions	Fixed in	Images
postcss-selector-parsernpm	2.2.3, 3.1.1, 3.1.2, 5.0.0+21 more	7.1.6	768

OSV records: GHSA-rj75-hqrm-r3gf
Trending: Rank 22 in indexed charts, since 6 Oct 2026. See the ranking →

Charts affected

767 by stars

Chart

Latest

Affected images

Radar Score

voting-app-envvoting-example-with-env

0.0.3

1 of 6 See more

voting-app-env voting-example-with-env 0.0.3

1 of the 6 container images this version deploys carry CVE-2026-104844.

Container image	Digest	Package	Fixed in
kerolosayman308/voting-app-env :examplevotingapp_result	6e92e5a231fa	postcss-selector-parser@6.1.0	7.1.6

Open the chart page →

7,958

websitewaldo-vision

0.33.0

2 of 2 See more

website waldo-vision 0.33.0

2 of the 2 container images this version deploys carry CVE-2026-104844.

Container image	Digest	Package	Fixed in
ghcr.io/waldo-vision/migrate :v0.3.6	ae31923312ed	postcss-selector-parser@6.0.11	7.1.6
ghcr.io/waldo-vision/web :v0.3.6	5bbc7647df07	postcss-selector-parser@6.0.11	7.1.6

Open the chart page →

4,124

sirenwateim

1.0.2

1 of 1 See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container image	Digest	Package	Fixed in
sigp/siren :v3.0.4	2c219b04758e	postcss-selector-parser@6.1.2	7.1.6

Open the chart page →

6,436

welcome-clientwelcome-client

26.0.0

1 of 1 See more

welcome-client welcome-client 26.0.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container image	Digest	Package	Fixed in
lucassandin/welcome-client :latest	48468b1ccd16	postcss-selector-parser@6.0.15	7.1.6

Open the chart page →

1,651

apisix-ingress-controllerwener

1.4.0

1 of 2 See more

apisix-ingress-controller wener 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container image	Digest	Package	Fixed in
ghcr.io/api7/adc :0.27.1	f65f53dd9668	postcss-selector-parser@7.1.1	7.1.6

Open the chart page →

2,087

cadencewener

0.23.0

1 of 5 See more

cadence wener 0.23.0

1 of the 5 container images this version deploys carry CVE-2026-104844.

Container image	Digest	Package	Fixed in
ubercadence/web :v3.29.5	8564a5b44a6d	postcss-selector-parser@2.2.3	7.1.6

Open the chart page →

13,179

temporalwener

0.15.1

1 of 13 See more

temporal wener 0.15.1

1 of the 13 container images this version deploys carry CVE-2026-104844.

Container image	Digest	Package	Fixed in
temporalio/web :1.14.0	33cfa863d8ce	postcss-selector-parser@2.2.3	7.1.6

Open the chart page →

29,471

verdacciowener

4.35.2

1 of 1 See more

verdaccio wener 4.35.2

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container image	Digest	Package	Fixed in
verdaccio/verdaccio :6.10.5	560744912b64	postcss-selector-parser@7.1.1	7.1.6

Open the chart page →

327

wikiwener

2.2.0

1 of 2 See more

wiki wener 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container image	Digest	Package	Fixed in
requarks/wiki :latest	fffff288a52f	postcss-selector-parser@7.1.4	7.1.6

Open the chart page →

2,599

apisix-ingress-controllerwenerme

1.4.0

1 of 2 See more

apisix-ingress-controller wenerme 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container image	Digest	Package	Fixed in
ghcr.io/api7/adc :0.27.1	f65f53dd9668	postcss-selector-parser@7.1.1	7.1.6

Open the chart page →

2,087

cadencewenerme

0.23.0

1 of 5 See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry CVE-2026-104844.

Container image	Digest	Package	Fixed in
ubercadence/web :v3.29.5	8564a5b44a6d	postcss-selector-parser@2.2.3	7.1.6

Open the chart page →

13,179

temporalwenerme

0.15.1

1 of 13 See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2026-104844.

Container image	Digest	Package	Fixed in
temporalio/web :1.14.0	33cfa863d8ce	postcss-selector-parser@2.2.3	7.1.6

Open the chart page →

29,471

verdacciowenerme

4.35.2

1 of 1 See more

verdaccio wenerme 4.35.2

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container image	Digest	Package	Fixed in
verdaccio/verdaccio :6.10.5	560744912b64	postcss-selector-parser@7.1.1	7.1.6

Open the chart page →

327

wikiwikijs

3.0.0

1 of 2 See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container image	Digest	Package	Fixed in
requarks/wiki :2	af71a17dc27c	postcss-selector-parser@7.1.4	7.1.6

Open the chart page →

4,321

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	postcss-selector-parser@6.0.16	7.1.6

Open the chart page →

15,686

workadventure-adminwork-adventure

1.0.0-21-3

4 of 14 See more

workadventure-admin work-adventure 1.0.0-21-3

4 of the 14 container images this version deploys carry CVE-2026-104844.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-back :helm-chart	53a30c962ce9	postcss-selector-parser@6.0.13	7.1.6
thecodingmachine/workadventure-map-storage :helm-chart	519c31c6e7ec	postcss-selector-parser@6.0.11	7.1.6
thecodingmachine/workadventure-play :helm-chart	df31006cc4ce	postcss-selector-parser@6.0.13	7.1.6
thecodingmachine/workadventure-uploader :helm-chart	962e98843fb2	postcss-selector-parser@6.0.13	7.1.6

Open the chart page →

19,835

workadventureworkadventure

1.1.0

4 of 9 See more

workadventure workadventure 1.1.0

4 of the 9 container images this version deploys carry CVE-2026-104844.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-back :v1.17.7	64001369dad5	postcss-selector-parser@6.0.10	7.1.6
thecodingmachine/workadventure-map-storage :v1.17.7	5bdab56da2fa	postcss-selector-parser@6.0.10	7.1.6
thecodingmachine/workadventure-play :v1.17.7	d8f66979b9b4	postcss-selector-parser@6.0.10	7.1.6
thecodingmachine/workadventure-uploader :v1.17.7	3ccd467543b3	postcss-selector-parser@6.0.10	7.1.6

Open the chart page →

20,456

Container images carrying it

768 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
foggbh/stocky :latest	8b7a2e5ecf4e	postcss-selector-parser@7.1.4	7.1.6	1
folioci/mod-graphql :latest	f0655a6a08fd	postcss-selector-parser@6.1.0	7.1.6	1
fonoster/routr-pgdata-migrations :2.13.6	c7b1dba81eb3	postcss-selector-parser@6.0.16	7.1.6	1
fosrl/pangolin :latest	00cfb631097a	postcss-selector-parser@7.1.1	7.1.6	1
fosrl/pangolin :1.13.0	c32ad797ab96	postcss-selector-parser@7.1.0	7.1.6	1
frinx/frinx-frontend :7.0.1	ab716463b8df	postcss-selector-parser@6.0.13	7.1.6	1
frinx/frinx-frontend :6.1.0	ac593f5b2e2f	postcss-selector-parser@6.0.13	7.1.6	1
frinx/frinx-graphql-proxy :7.0.0	17a139608024	postcss-selector-parser@6.0.16	7.1.6	1
frinx/frinx-graphql-proxy :6.1.0	5f1368ef47b8	postcss-selector-parser@6.0.16	7.1.6	1
frinx/frinx-inventory-server :7.0.1	6b1992c79e78	postcss-selector-parser@6.0.16	7.1.6	1
frinx/frinx-inventory-server :6.1.0	86c9ce1f5e31	postcss-selector-parser@6.0.16	7.1.6	1
fthomas/scala-steward :latest	a8eb43927576	postcss-selector-parser@7.1.1	7.1.6	1
gethue/hue :latest	7d5c1b9f8a79	postcss-selector-parser@7.1.1	7.1.6	1
getwud/wud :8.1.1	b1cd01c43839	postcss-selector-parser@6.1.2	7.1.6	1
ghostfolio/ghostfolio :3.7.0	e3c6ab53e49b	postcss-selector-parser@7.1.1	7.1.6	1
globalping/globalping-probe :latest	b8469caf783a	postcss-selector-parser@7.1.1	7.1.6	1
hamid2021/nodejs-dockercli :latest	429d99890c3c	postcss-selector-parser@6.0.13	7.1.6	1
hansehe/graphql-gateway :1.0.4	58e09540afbc	postcss-selector-parser@6.0.13	7.1.6	1
haohanyang/compass-web :0.5.0	54f2112602ee	postcss-selector-parser@7.1.1	7.1.6	1
haohanyang/compass-web :0.1.1	e3952b14ae8e	postcss-selector-parser@6.1.0	7.1.6	1
haohanyang/compass-web :0.5.1	f4f8fe4e21f1	postcss-selector-parser@7.1.4	7.1.6	1
haveagitgat/tdarr_node :2.17.01	3ff0913202dd	postcss-selector-parser@6.0.13	7.1.6	1
hecrom/myweatherprocessingreactclient :1.3.11	5454b54d5b28	postcss-selector-parser@6.0.11	7.1.6	1
helga09/shoes_ukr :v1.1.1	7999bc8b77c0	postcss-selector-parser@6.0.12	7.1.6	1
helicone/supabase-migration-runner :v2025.03.05-1	4a913936c97b	postcss-selector-parser@6.0.13	7.1.6	1
helmforge/opencut :v0.3.0	bf11156e0ab5	postcss-selector-parser@7.1.4	7.1.6	1
helmforge/strapi-base :5.52.2	70e9143d6d92	postcss-selector-parser@7.1.1	7.1.6	1
henrywhitaker3/speedtest-tracker :latest	47159a940229	postcss-selector-parser@3.1.2	7.1.6	1
heywood8/redisinsight :2.28.0	0bc9ab313d37	postcss-selector-parser@6.0.11	7.1.6	1
hirosystems/stacks-blockchain-api :8.13.2	9c98b23c1515	postcss-selector-parser@7.1.0	7.1.6	1
hkotel/mealie :frontend-v1.0.0beta-2	3c04c0e85039	postcss-selector-parser@6.0.8	7.1.6	1
honglab/slack-emoji-maker :v0.0.1	ca075a926fe1	postcss-selector-parser@6.1.0	7.1.6	1
hoppscotch/hoppscotch :2024.11.0	538fe6ded4b6	postcss-selector-parser@6.1.2	7.1.6	1
hoppscotch/hoppscotch :2026.8.2	e7ba6061a286	postcss-selector-parser@7.1.5	7.1.6	1
ilum/marquez-web :0.53.2	716437a51a6c	postcss-selector-parser@7.1.0	7.1.6	1
infisical/infisical :latest	3365445909be	postcss-selector-parser@7.1.1	7.1.6	1
infisical/infisical :v0.165.16	6b911e3938ac	postcss-selector-parser@7.1.1	7.1.6	1
inseefrlab/onyxia-web :5.8.1	0d55a69fbd4c	postcss-selector-parser@7.1.1	7.1.6	1
instructure/kinesalite :latest	34400d82f28f	postcss-selector-parser@6.0.13	7.1.6	1
intelloop/atlas-cmms-frontend :v1.5.1	2409c2a00ab6	postcss-selector-parser@6.0.13	7.1.6	1
interlayhq/interbtc-hydra-processor :0.10.5	5b2c414307b9	postcss-selector-parser@6.0.10	7.1.6	1
iwakitakuma/gitlab-mcp :2.0.7	fb3e81aa6528	postcss-selector-parser@6.1.2	7.1.6	1
jaedb/iris :latest	048cfbf58d57	postcss-selector-parser@6.1.0	7.1.6	1
jayfong/yapi :1.10.2	163e5d621910	postcss-selector-parser@2.2.3	7.1.6	1
jedi132000/nextapp :latest	dc2a81e92f23	postcss-selector-parser@6.0.10	7.1.6	1
jesec/flood :4.14.3	c887dad96b40	postcss-selector-parser@7.1.1	7.1.6	1
jhidalgo3/hello-kubernetes :1.0.0.1397bf5d	dfa8628d79f5	postcss-selector-parser@6.1.0	7.1.6	1
jkroepke/github_exporter :1.8.0	3d850992786d	postcss-selector-parser@7.1.0	7.1.6	1
johly/airtrail :v3.11.1	9f702b91e0e7	postcss-selector-parser@7.1.1	7.1.6	1
joplin/server :3.0-beta	52af57880c0e	postcss-selector-parser@6.0.10	7.1.6	1