CVE-2026-104844 PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The...

CVE-2026-104844 PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The...