CVE-2026-104844

About vulnerability

Impact

. and # are not word delimiters in the tokenizer, so a flat selector such as .a.a.a... reaches splitWord() as a single word token carrying n class or id indexes. Three passes scanned those index arrays linearly for every index, making the parse O(n^2) in the number of indexes rather than in input length: uniqs(), the indices.forEach loop, and the Sass-interpolation filter. Parsing a 400 KB flat selector took ~34 s on a modern laptop, fully occupying a single thread. A benign selector of identical byte size parses in tens of milliseconds, so the cost is driven by the index count, not the input size. The nesting depth of such a selector is 0, so the maxNestingDepth guard added in 7.1.3 offers no protection.

Reachability is deployment dependent. Only consumers that parse untrusted, attacker-supplied selectors synchronously in a request path are exposed, for example CSS sanitizers, CSS-in-JS services and online playgrounds. Ordinary build-time use on trusted sources is not affected.

Patches

Fixed in 7.1.6. The three passes now use Set membership tests, making parsing linear in the number of indexes. There is no behaviour change: parsing is byte-identical on a differential corpus of 8413 selectors.

Workarounds

Cap the size of selectors accepted from untrusted sources before parsing.

Affected product:

Express , Next.js , React , Vue , aegir , assetgraph , astro-expressive-code , astrojs-starlight , astrojs-tailwind , aws-cdk , babel-plugin-remove-graphql-queries , callstack-repack , callstack-repack-init , callstack-repack-plugin-expo-modules , callstack-repack-plugin-nativewind , callstack-repack-plugin-reanimated , chialab-es-dev-server , chialab-es-test-runner , chialab-esbuild-plugin-any-file , chialab-esbuild-plugin-env , chialab-esbuild-plugin-postcss , chialab-node-resolve , chialab-postcss-dart-sass , chialab-rna , chialab-rna-browser-test-runner , chialab-rna-config-loader , chialab-rna-dev-server , chialab-rna-logger , chialab-rna-node-test-runner , chialab-rna-saucelabs-test-runner , chialab-wds-plugin-hmr , chialab-wds-plugin-legacy , chialab-wds-plugin-node-resolve , chialab-wds-plugin-polyfill , chialab-wds-plugin-rna , chialab-wtr-coverage-reporter , chialab-wtr-mocha-reporter , commit-analyzer , component-compiler-utils , create-react-app , create-rspeedy , create-storybook , create-video , create-zephyr-apps , css-blank-pseudo , css-has-pseudo , css-loader , css-minimizer-webpack-plugin , css-prefers-color-scheme , cssnano , cssnano-preset-advanced , cssnano-preset-default , cssnano-utils , csstools-cascade-layer-name-parser , csstools-color-helpers , csstools-css-color-parser , csstools-media-query-list-parser , csstools-postcss-bundler , csstools-postcss-cascade-layers , csstools-postcss-color-function , csstools-postcss-content-alt-text , csstools-postcss-design-tokens , csstools-postcss-hwb-function , csstools-postcss-is-pseudo-class , csstools-postcss-light-dark-function , csstools-postcss-logical-float-and-clear , csstools-postcss-logical-resize , csstools-postcss-media-minmax , csstools-postcss-minify , csstools-postcss-nested-calc , csstools-postcss-oklab-function , csstools-postcss-private-rule , csstools-postcss-rebase-url , csstools-postcss-rewrite-url , csstools-postcss-scope-pseudo-class , csstools-postcss-todo-or-die , csstools-postcss-trigonometric-functions , csstools-postcss-unset-value , csstools-selector-resolve-nested , csstools-selector-specificity , csstools-stylelint-no-invalid-at-import-rules-when-bundling , docsearch , docusaurus , docusaurus-bundler , docusaurus-core , docusaurus-cssnano-preset , docusaurus-plugin-content-blog , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-css-cascade-layers , docusaurus-plugin-debug , docusaurus-plugin-google-analytics , docusaurus-plugin-google-gtag , docusaurus-plugin-google-tag-manager , docusaurus-plugin-sitemap , docusaurus-plugin-svgr , docusaurus-preset-classic , docusaurus-search-local , docusaurus-theme-classic , docusaurus-theme-common , docusaurus-theme-mermaid , docusaurus-theme-search-algolia , electron-webpack , eslint-plugin-vue , expo , expo-dev-tools , expo-electron-adapter , expo-expo-cli , expo-image , expo-linking , expo-modules-core , expo-next-adapter , expo-prebuild-config , expo-screen-capture , expo-standard-web-crypto , expo-status-bar , expo-symbols , expo-webpack-config , expo-xdl , expo-yarn-workspaces , fcl-js , gatsby , gatsby-cypress , gatsby-interface , gatsby-plugin-compile-es6-packages , gatsby-plugin-emotion , gatsby-plugin-fathom , gatsby-plugin-feed , gatsby-plugin-google-gtag , gatsby-plugin-guess-js , gatsby-plugin-less , gatsby-plugin-manifest , gatsby-plugin-netlify , gatsby-plugin-no-sourcemaps , gatsby-plugin-offline , gatsby-plugin-page-creator , gatsby-plugin-postcss , gatsby-plugin-preact , gatsby-plugin-preload-fonts , gatsby-plugin-react-helmet , gatsby-plugin-schema-snapshot , gatsby-plugin-sharp , gatsby-plugin-sitemap , gatsby-plugin-styletron , gatsby-plugin-subfont , gatsby-plugin-typography , gatsby-react-router-scroll , gatsby-remark-code-repls , gatsby-remark-embed-snippet , gatsby-remark-prismjs , gatsby-remark-responsive-iframe , gatsby-source-contentful , gatsby-source-drupal , gatsby-source-filesystem , gatsby-source-graphql , gatsby-source-shopify , gatsby-source-wordpress , gatsby-transformer-react-docgen , gatsby-transformer-remark , gatsby-transformer-sqip , gatsby-transformer-toml , github , hindsight , htmlnano , infima , jest-expo-enzyme , jovidecroock-prefresh , ledger-cosmos-js , ledgerhq-live-cli , ledgerhq-live-common , libnpmdiff , libnpmexec , libnpmfund , libp2p-interface-compliance-tests , libp2p-interop , lynx-js-react-alias-rsbuild-plugin , lynx-js-react-rsbuild-plugin , lynx-js-rspeedy , lynx-js-tailwind-preset , lynx-js-template-webpack-plugin , lynx-js-web-constants , lynx-js-web-core , lynx-js-web-worker-rpc , lynx-js-web-worker-runtime , lynx-stack , lynx-ui , magic-js , mastra-playground-ui , mdx , metamask-core , modern-js-adapter-rstest , modern-js-app-tools , modern-js-babel-compiler , modern-js-babel-plugin-module-resolver , modern-js-babel-preset , modern-js-builder , modern-js-core , modern-js-flight-server-transform-plugin , modern-js-plugin-bff , modern-js-plugin-i18n , modern-js-plugin-polyfill , modern-js-prod-server , modern-js-rsbuild-plugin-esbuild , modern-js-server , modern-js-server-core , modern-js-server-utils , modern-js-tsconfig , modern-js-uni-builder , modern-js-utils , modern.js , nativewind , npm , npm:gatsby-theme-blog-core , npm:libnpmpack , npmcli-arborist , npmcli-query , nuxt , nuxt-kit , nuxt-schema , nuxt-vite-builder , nuxt-webpack-builder , oclif-plugin-plugins , octanejs-docusaurus , onflow-fcl , onflow-fcl-rainbowkit-adapter , onflow-fcl-wc , onflow-react-sdk , optimize-css-assets-webpack-plugin , orama-orama , panda , pandacss-core , pandacss-dev , pandacss-generator , pandacss-mcp , pandacss-node , pandacss-parser , pandacss-postcss , pandacss-reporter , pandacss-types , parcel-bundler , postcss-attribute-case-insensitive , postcss-calc , postcss-color-functional-notation , postcss-combine-duplicated-selectors , postcss-convert-values , postcss-cssnext , postcss-custom-selectors , postcss-dir-pseudo-class , postcss-discard-comments , postcss-discard-empty , postcss-discard-overridden , postcss-discard-unused , postcss-focus-visible , postcss-focus-within , postcss-gap-properties , postcss-logical , postcss-merge-idents , postcss-merge-longhand , postcss-merge-rules , postcss-minify-font-values , postcss-minify-gradients , postcss-minify-params , postcss-minify-selectors , postcss-modules-local-by-default , postcss-modules-scope , postcss-nested , postcss-nesting , postcss-normalize-display-values , postcss-normalize-positions , postcss-normalize-repeat-style , postcss-normalize-string , postcss-normalize-timing-functions , postcss-normalize-unicode , postcss-normalize-url , postcss-normalize-whitespace , postcss-plugins , postcss-pseudo-class-any-link , postcss-reduce-idents , postcss-reduce-initial , postcss-selector-not , postcss-selector-parser , postcss-unique-selectors , postcss-zindex , probe.gl , purgecss , rehype-expressive-code , release-notes-generator , remark-expressive-code , remotion , remotion-animated-emoji , remotion-animation-utils , remotion-babel-loader , remotion-browser-bundler , remotion-bundler , remotion-captions , remotion-cli , remotion-cloudrun , remotion-codemods , remotion-compositor-darwin-arm64 , remotion-compositor-darwin-x64 , remotion-compositor-linux-arm64-gnu , remotion-compositor-linux-arm64-musl , remotion-compositor-linux-x64-gnu , remotion-compositor-linux-x64-musl , remotion-compositor-win32-x64-msvc , remotion-design , remotion-effects , remotion-elevenlabs , remotion-enable-scss , remotion-eslint-config , remotion-eslint-config-flat , remotion-eslint-plugin , remotion-fonts , remotion-gif , remotion-google-fonts , remotion-gsap , remotion-install-whisper-cpp , remotion-lambda , remotion-lambda-client , remotion-layout-utils , remotion-licensing , remotion-light-leaks , remotion-lottie , remotion-mac-cursors , remotion-maptiler , remotion-mcp , remotion-media , remotion-media-parser , remotion-media-utils , remotion-motion-blur , remotion-noise , remotion-openai-whisper , remotion-paths , remotion-player , remotion-preload , remotion-promo-pages , remotion-renderer , remotion-rive , remotion-rough-notation , remotion-rounded-text-box , remotion-sdk , remotion-serverless , remotion-serverless-client , remotion-sfx , remotion-shapes , remotion-skia , remotion-starburst , remotion-streaming , remotion-studio , remotion-studio-protocol , remotion-studio-server , remotion-studio-shared , remotion-svg-3d-engine , remotion-tailwind , remotion-tailwind-v4 , remotion-three , remotion-timeline-utils , remotion-transitions , remotion-vercel , remotion-video-matting , remotion-web-renderer , remotion-webcodecs , remotion-whisper-web , remotion-whisper-webgpu , remotion-zod-types , remotion-zod-types-v3 , repack , rna , rollup-plugin-zephyr , rsbuild-plugin-css-minimizer , rushstack-heft-web-rig , satteri-expressive-code , sb , scalar-starlight , semantic-release , semantic-release-changelog , semantic-release-git , semantic-release-monorepo , semantic-release-npm , semantic-release-plugin-decorators , sentry-astro , sentry-deno , sentry-effect , sentry-elysia , sentry-ember , sentry-eslint-config-sdk , sentry-eslint-plugin-sdk , sentry-gatsby , sentry-google-cloud-serverless , sentry-hono , sentry-javascript , sentry-nitro , sentry-node-native , sentry-replay , sentry-server-runtime-injection , sentry-server-utils , sentry-solid , sentry-solidstart , sentry-tanstackstart , sentry-tanstackstart-react , sentry-wasm , services , storybook , storybook-addon-a11y , storybook-addon-docs , storybook-addon-links , storybook-addon-onboarding , storybook-addon-pseudo-states , storybook-addon-themes , storybook-addon-vitest , storybook-angular , storybook-angular-vite , storybook-builder-webpack5 , storybook-cli , storybook-codemod , storybook-core , storybook-core-server , storybook-core-webpack , storybook-ember , storybook-html , storybook-html-vite , storybook-nextjs , storybook-nextjs-vite , storybook-preact , storybook-preset-create-react-app , storybook-preset-react-webpack , storybook-preset-server-webpack , storybook-react , storybook-react-dom-shim , storybook-react-native-web-vite , storybook-react-vite , storybook-react-webpack5 , storybook-server , storybook-server-webpack5 , storybook-svelte , storybook-tanstack-react , storybook-vue3 , storybook-vue3-vite , storybook-vue3-webpack5 , storybook-web-components , storybook-web-components-vite , storybook-web-components-webpack5 , stylehacks , stylelint , stylelint-scss , stylelint-stylistic , subfont , svgr , svgr-babel-plugin-add-jsx-attribute , svgr-babel-plugin-remove-jsx-empty-expression , svgr-babel-plugin-replace-jsx-attribute-value , svgr-babel-plugin-svg-em-dimensions , svgr-babel-plugin-transform-react-native-svg , svgr-babel-plugin-transform-svg-component , svgr-babel-preset , svgr-core , svgr-hast-util-to-babel-ast , svgr-plugin-jsx , svgr-plugin-prettier , svgr-plugin-svgo , tachyons-build-css , tachyons-generator , tailwindcss , tailwindcss-typography , theme-ui , uncss , upgrade-rspeedy , vectorize-io-hindsight-client , vetur , vite-plugin-tanstack-start-zephyr , vite-plugin-vinext-zephyr , vite-plugin-zephyr , volar-service-json , volar-service-pug , volar-service-pug-beautify , web-infra-dev/modern.js , with-zephyr , wordpress-build , wordpress-scripts , wordpress-stylelint-config , xdl , zbsearch , zbsearch-docs-index , zbsearch-edge-core , zbsearch-edge-index-builder , zbsearch-highlight , zbsearch-plugin-data-persistence , zbsearch-plugin-docusaurus , zbsearch-plugin-embeddings , zbsearch-plugin-match-highlight , zbsearch-plugin-parsedoc , zbsearch-plugin-pt15 , zbsearch-plugin-qps , zbsearch-plugin-starlight , zbsearch-plugin-vitepress , zbsearch-runtime-cloudflare , zbsearch-searchbox-core , zbsearch-searchbox-react , zbsearch-searchbox-vue , zbsearch-static , zbsearch-stemmers , zbsearch-stopwords , zbsearch-tokenizers , zephyr-agent , zephyr-astro-integration , zephyr-edge-contract , zephyr-metro-plugin , zephyr-modernjs-plugin , zephyr-native-cache , zephyr-nuxt-module , zephyr-packages , zephyr-repack-plugin , zephyr-rolldown-plugin , zephyr-rsbuild-plugin , zephyr-rspack-plugin , zephyr-rspress-plugin , zephyr-tap-runtime , zephyr-webpack-plugin , zephyr-xpack-internal

Affected packages:

postcss-selector-parser @ 6.1.2 (+5704 more)