PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

Impact . and are not word delimiters in the tokenizer, so a flat selector such as .a.a.a... reaches splitWord as a single word token carrying n class or id indexes. Three passes scanned those index arrays linearly for every index, making the parse On^2 in the number of indexes rather than in inpu...

GHSA-RJ75-HQRM-R3GF PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

Impact . and are not word delimiters in the tokenizer, so a flat selector such as .a.a.a... reaches splitWord as a single word token carrying n class or id indexes. Three passes scanned those index arrays linearly for every index, making the parse On^2 in the number of indexes rather than in inpu...

CVE-2026-104844 PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The...

CVE-2026-104844 PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The...