{{ message }}
Repository navigation
[GHSA-rj75-hqrm-r3gf] PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion - #10456
Open
MoOx wants to merge 1 commit into
Open
[GHSA-rj75-hqrm-r3gf] PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion#10456MoOx wants to merge 1 commit into
MoOx wants to merge 1 commit into
Conversation
Collaborator
github-actions
Bot
changed the base branch from
main
to
MoOx/advisory-improvement-10456
October 20, 2026 08:33
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
A security curator should confirm that the published npm 6.1.5 package contains the backported fix.
No open issues 🎉
What changed in this PR
Updates the PostCSS selector-parser advisory to recognize the non-breaking security fix for 6.x users.
Changes:
- Split affected ranges around fixes in 6.1.5 and 7.1.6.
- Update patch guidance and add backport references.
Review effort: Max
alexiscrocilla
added a commit
to alexiscrocilla/Lull-Mail
that referenced
this pull request
Oct 21, 2026
- @playwright/test 1.55.0 -> 1.55.1 (GHSA-7mvr-c777-76hp: curl -k in the macOS branded-browser reinstall scripts). Chromium moves from build 1187 to 1193; the committed screenshot baselines still match. - source-map-js 1.2.1 -> 1.2.2 (GHSA-68fv-2mgg-jv7q), inside postcss's ^1.2.1 range. - postcss-selector-parser 6.1.4 -> 6.1.5 (GHSA-rj75-hqrm-r3gf), the upstream backport of the 7.1.6 fix; tailwindcss 3 requires ^6.1.2. GitHub's advisory still lists every 6.x as affected until github/advisory-database#10456 is merged, so that alert stays open until then even though the code is fixed. All three are build and test tooling; nothing here ships in the app, and the generated tailwind.css is byte-identical.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates
Comments
I maintain postcss-selector-parser and this advisory originated from a repository security advisory of mine: the GHSA was created on 2026-08-31 and published on 2026-09-03 from https://github.com/postcss/postcss-selector-parser, and CVE-2026-104844 was assigned by GitHub (assignerShortName: GitHub_M in the CVE record). No third-party CNA is involved, so this is not a correction that has to be requested upstream.
The fix has since been backported to the 6.x line and released as 6.1.5 on 2026-10-19, so the single range >= 0, < 7.1.6 is no longer accurate on two counts. It marks 6.1.5 as vulnerable although it carries the fix, and it offers no remediation within the 6.x line: the only upgrade it points at is a major version bump.
That distinction matters for this package. The 6.x line is 54.7% of its downloads (45.5M of 83.2M last week), and its most downloaded version is 6.1.2 at 17.4M a week, which is the floor of Tailwind CSS 3’s dependency range ("postcss-selector-parser": "^6.1.2"). Tailwind CSS 4 no longer depends on this package at all, so that installed base cannot reach 7.x by upgrading Tailwind. Those users currently get an alert with no non-breaking fix available, which is what prompted postcss/postcss-selector-parser#344.
Requested change, splitting the single range in two, following the convention used for other multi-branch fixes such as GHSA-c2qf-rxjj-qqgw:
Versions below 6.0.0 have no fixed release of their own, so they stay covered by the second range and are pointed at 6.1.5.
References:
6.1.5 release: https://github.com/postcss/postcss-selector-parser/releases/tag/6.1.5
backport commit on 6.x.x: postcss/postcss-selector-parser@70b0779
original fix in 7.1.6: postcss/postcss-selector-parser@62b1917
the repository advisory already carries both ranges: GHSA-rj75-hqrm-r3gf