StackRadar

CVE-2026-104844

Medium

Advisory

Published 5 Oct 2026In the index since 6 Oct 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.004
31st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
777
of 18,026 indexed, latest versions
Container images
781
deployed by those charts
Fix available
1 of 1
affected package

PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

Carried by container images the latest versions of 777 of 18,026 indexed charts deploy, on 781 images.

Affected packageAffected versionsFixed inImages
postcss-selector-parsernpm2.2.3, 3.1.1, 3.1.2, 5.0.0+21 more7.1.6781
OSV records
GHSA-rj75-hqrm-r3gf
Trending
Rank 22 in indexed charts, since 6 Oct 2026. See the ranking →

Charts affected

777 by stars
ChartLatestAffected imagesRadar Score
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

5,214
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

2,706
n8nvictorlane1.0.181 of 1See more

n8n victorlane 1.0.18

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
n8nio/n8n:1.115.1ed16e560c40e
postcss-selector-parser@7.1.0
7.1.6

Open the chart page →

7,503
video-dl-botvideo-dl-botVerified publisher1.4.31 of 1See more

video-dl-bot video-dl-bot 1.4.3

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/tarampampam/video-dl-bot:1.4.36daa2dc7556b
postcss-selector-parser@7.1.4
7.1.6

Open the chart page →

2,239
hedgedocvista0.1.11 of 1See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

3,473
vote-appvote-appVerified publisher1.0.71 of 6See more

vote-app vote-app 1.0.7

1 of the 6 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
thecloudspark/app-result:1.09a5302cb8312
postcss-selector-parser@6.0.16
7.1.6

Open the chart page →

3,217
resultappvoting-app-helm-charts-repoVerified publisher1.0.01 of 1See more

resultapp voting-app-helm-charts-repo 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

1,559
voteappvoting-app-helm-charts-repoVerified publisher1.0.01 of 5See more

voteapp voting-app-helm-charts-repo 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

9,766
resultappvoting-app-helm-charts-repo-cloudVerified publisher1.0.01 of 1See more

resultapp voting-app-helm-charts-repo-cloud 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

1,559
voteappvoting-app-helm-charts-repo-cloudVerified publisher1.0.01 of 5See more

voteapp voting-app-helm-charts-repo-cloud 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

9,766
voting-app-envvoting-example-with-env0.0.31 of 6See more

voting-app-env voting-example-with-env 0.0.3

1 of the 6 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
kerolosayman308/voting-app-env:examplevotingapp_result6e92e5a231fa
postcss-selector-parser@6.1.0
7.1.6

Open the chart page →

7,958
websitewaldo-visionVerified publisher0.33.02 of 2See more

website waldo-vision 0.33.0

2 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/waldo-vision/migrate:v0.3.6ae31923312ed
postcss-selector-parser@6.0.11
7.1.6
ghcr.io/waldo-vision/web:v0.3.65bbc7647df07
postcss-selector-parser@6.0.11
7.1.6

Open the chart page →

4,124
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
postcss-selector-parser@6.1.2
7.1.6

Open the chart page →

6,436
welcome-clientwelcome-client26.0.01 of 1See more

welcome-client welcome-client 26.0.0

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
lucassandin/welcome-client:latest48468b1ccd16
postcss-selector-parser@6.0.15
7.1.6

Open the chart page →

1,651
apisix-ingress-controllerwener1.4.01 of 2See more

apisix-ingress-controller wener 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/api7/adc:0.27.1f65f53dd9668
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

2,087
cadencewener0.23.01 of 5See more

cadence wener 0.23.0

1 of the 5 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ubercadence/web:v3.29.58564a5b44a6d
postcss-selector-parser@2.2.3
7.1.6

Open the chart page →

13,179
temporalwener0.15.11 of 13See more

temporal wener 0.15.1

1 of the 13 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
postcss-selector-parser@2.2.3
7.1.6

Open the chart page →

29,471
verdacciowener4.35.21 of 1See more

verdaccio wener 4.35.2

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
verdaccio/verdaccio:6.10.5560744912b64
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

327
wikiwener2.2.01 of 2See more

wiki wener 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
requarks/wiki:latestfffff288a52f
postcss-selector-parser@7.1.4
7.1.6

Open the chart page →

2,599
apisix-ingress-controllerwenerme1.4.01 of 2See more

apisix-ingress-controller wenerme 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ghcr.io/api7/adc:0.27.1f65f53dd9668
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

2,087
cadencewenerme0.23.01 of 5See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
ubercadence/web:v3.29.58564a5b44a6d
postcss-selector-parser@2.2.3
7.1.6

Open the chart page →

13,179
temporalwenerme0.15.11 of 13See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
postcss-selector-parser@2.2.3
7.1.6

Open the chart page →

29,471
verdacciowenerme4.35.21 of 1See more

verdaccio wenerme 4.35.2

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
verdaccio/verdaccio:6.10.5560744912b64
postcss-selector-parser@7.1.1
7.1.6

Open the chart page →

327
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
requarks/wiki:2af71a17dc27c
postcss-selector-parser@7.1.4
7.1.6

Open the chart page →

4,321
playwright-synthetic-monitoringwork-adventure1.0.11 of 1See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
postcss-selector-parser@6.0.16
7.1.6

Open the chart page →

15,686
workadventure-adminwork-adventure1.0.0-21-34 of 14See more

workadventure-admin work-adventure 1.0.0-21-3

4 of the 14 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-back:helm-chart53a30c962ce9
postcss-selector-parser@6.0.13
7.1.6
thecodingmachine/workadventure-map-storage:helm-chart519c31c6e7ec
postcss-selector-parser@6.0.11
7.1.6
thecodingmachine/workadventure-play:helm-chartdf31006cc4ce
postcss-selector-parser@6.0.13
7.1.6
thecodingmachine/workadventure-uploader:helm-chart962e98843fb2
postcss-selector-parser@6.0.13
7.1.6

Open the chart page →

19,835
workadventureworkadventure1.1.04 of 9See more

workadventure workadventure 1.1.0

4 of the 9 container images this version deploys carry CVE-2026-104844.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-back:v1.17.764001369dad5
postcss-selector-parser@6.0.10
7.1.6
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
postcss-selector-parser@6.0.10
7.1.6
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
postcss-selector-parser@6.0.10
7.1.6
thecodingmachine/workadventure-uploader:v1.17.73ccd467543b3
postcss-selector-parser@6.0.10
7.1.6

Open the chart page →

20,456

Container images carrying it

781 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
decisionrules/server:latestbb3a93224b5a
postcss-selector-parser@7.1.1
7.1.6
4
kodekloud/examplevotingapp_result:v1e510023fdf38
postcss-selector-parser@6.0.10
7.1.6
4
redis/redisinsight:3.8:latestb5e19ee240ab
postcss-selector-parser@7.1.0
7.1.6
4
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
postcss-selector-parser@6.0.10
7.1.6
4
assistiot/dlt_api:2.0.0e36a8922fa0c
postcss-selector-parser@6.0.10
7.1.6
3
joplin/server:3.7.2:latest3f7b852959aa
postcss-selector-parser@7.1.4
7.1.6
3
library/node:lts64af3819f927
postcss-selector-parser@7.1.4
7.1.6
3
library/node:24.21.0-alpine:lts-alpineebfe2f904627
postcss-selector-parser@7.1.4
7.1.6
3
rcdelacruz/my-strapi-app:js-amd6438007f358355
postcss-selector-parser@6.0.13
7.1.6
3
verdaccio/verdaccio:6.10.5560744912b64
postcss-selector-parser@7.1.1
7.1.6
3
ghcr.io/api7/adc:0.27.1f65f53dd9668
postcss-selector-parser@7.1.1
7.1.6
3
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
postcss-selector-parser@6.0.10
7.1.6
3
ghcr.io/kamilkisiela/graphql-hive/emails:59b64c36c866b3555c135c70de76a884e63f86197d2d6d7c099a
postcss-selector-parser@6.0.10
7.1.6
3
ghcr.io/kamilkisiela/graphql-hive/schema:59b64c36c866b3555c135c70de76a884e63f8619931d1f6e5ad4
postcss-selector-parser@6.0.10
7.1.6
3
ghcr.io/kamilkisiela/graphql-hive/server:59b64c36c866b3555c135c70de76a884e63f86196d3899d281cc
postcss-selector-parser@6.0.10
7.1.6
3
ghcr.io/kamilkisiela/graphql-hive/storage:59b64c36c866b3555c135c70de76a884e63f86199808dac13353
postcss-selector-parser@6.0.10
7.1.6
3
ghcr.io/kamilkisiela/graphql-hive/tokens:59b64c36c866b3555c135c70de76a884e63f86190f3416d940b4
postcss-selector-parser@6.0.10
7.1.6
3
ghcr.io/kamilkisiela/graphql-hive/usage:59b64c36c866b3555c135c70de76a884e63f861953619ee7614e
postcss-selector-parser@6.0.10
7.1.6
3
ghcr.io/kamilkisiela/graphql-hive/usage-ingestor:59b64c36c866b3555c135c70de76a884e63f861947b87c071af4
postcss-selector-parser@6.0.10
7.1.6
3
ghcr.io/kamilkisiela/graphql-hive/webhooks:59b64c36c866b3555c135c70de76a884e63f861918a5c5b5b671
postcss-selector-parser@6.0.10
7.1.6
3
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
postcss-selector-parser@7.1.1
7.1.6
3
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
postcss-selector-parser@7.1.0
7.1.6
3
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
postcss-selector-parser@7.1.1
7.1.6
3
actualbudget/actual-server:26.10.024645e971da6
postcss-selector-parser@7.1.4
7.1.6
2
agoldis/sorry-cypress-api:2.5.11afaa5a84051d
postcss-selector-parser@6.0.10
7.1.6
2
agoldis/sorry-cypress-director:2.5.1110228ecd353b
postcss-selector-parser@6.0.10
7.1.6
2
chatwoot/chatwoot:v3.1.0d530ab8c1753
postcss-selector-parser@3.1.2
7.1.6
2
epamedp/krci-portal:0.8.0687acf641097
postcss-selector-parser@6.0.16
7.1.6
2
ethersphere/bee-localchain:latest0558799ca992
postcss-selector-parser@6.0.13
7.1.6
2
freikin/dawarich:1.15.2e58334ca5697
postcss-selector-parser@6.0.13
7.1.6
2
gjeanmart/safe-ganache-node:latest926264c8f2d1
postcss-selector-parser@6.0.13
7.1.6
2
gradiant/open5gs-webui:2.7.5fbd10c017541
postcss-selector-parser@6.0.13
7.1.6
2
homebridge/homebridge:latest22cdfca31934
postcss-selector-parser@7.1.4
7.1.6
2
hoppscotch/hoppscotch:2024.8.2f1da831950b7
postcss-selector-parser@6.1.0
7.1.6
2
ilum/ui:6.7.3998937726679
postcss-selector-parser@7.1.0
7.1.6
2
krtk6160/galoy-nostrcc82a694f818
postcss-selector-parser@6.0.10
7.1.6
2
kutt/kutt:latest:v3.2.6fa3d24a89b04
postcss-selector-parser@7.1.1
7.1.6
2
l7mp/kurento-one2one-call-server:latestfd2b2d06fff6
postcss-selector-parser@6.0.10
7.1.6
2
langflowai/langflow:latest4304bd9e67db
postcss-selector-parser@7.1.4
7.1.6
2
langgenius/dify-sandbox:0.2.009b7e8705673
postcss-selector-parser@6.0.13
7.1.6
2
library/ghost:6.67.0428ce627d581
postcss-selector-parser@7.1.1
7.1.6
2
library/mongo-express:1.0.2:latest1b23d7976f02
postcss-selector-parser@6.0.16
7.1.6
2
library/node:24.21.0-alpine3.239ec4a2e28987
postcss-selector-parser@7.1.4
7.1.6
2
louislam/uptime-kuma:2.5.4917318f9d7be
postcss-selector-parser@7.1.1
7.1.6
2
louislam/uptime-kuma:1.23.1396510915e6be
postcss-selector-parser@6.0.15
7.1.6
2
louislam/uptime-kuma:2.3.29aeb4e51d038
postcss-selector-parser@7.1.1
7.1.6
2
louislam/uptime-kuma:2.5.0a8610b3b4c38
postcss-selector-parser@7.1.1
7.1.6
2
louislam/uptime-kuma:2.5.5c74379ac4509
postcss-selector-parser@7.1.1
7.1.6
2
mojaloop/reporting:v12.1.0d480a62103d6
postcss-selector-parser@6.1.0
7.1.6
2
mojaloop/reporting-aggregator-svc:v0.0.92635baf23298
postcss-selector-parser@6.1.2
7.1.6
2

syft 1.42.1 · advisories as of 6 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.