PostCSS Selector Parser CVE-2026-104844

Exploitation requires that the consuming application synchronously parse attacker-controlled CSS selectors on an exposed/reachable request path (e.g., a runtime endpoint that feeds untrusted selector strings into parser().astSync or equivalent); the vendor states ordinary build-time parsing of trusted sources is NOT affected. The limiting factors are substantial: untrusted-input parsing at runtime is a non-default, developer-chosen integration pattern, exploitation is availability-only (no data exposure or integrity impact), and the maxNestingDepth guard provides no mitigation because the hostile selector has zero nesting depth. Authentication is not required (CVSS PR:N), so where the precondition holds, remote unauthenticated attackers can trigger it.

This is a moderate, conditional risk rather than a top-tier priority. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.9) correctly captures the nature of the flaw: a network-reachable, unauthenticated availability-only CPU-exhaustion bug (CWE-400) with high attack complexity, because exploitation depends on an application choosing to synchronously parse attacker-controlled CSS selectors in an exposed request path - explicitly NOT the ordinary build-time, trusted-source usage that dominates deployments. There is no EPSS score, no KEV listing, and no weaponized exploit in the provided data (exploitation status: no public exploit identified at time of analysis); the GitHub commit ships regression/complexity tests, not a drop-in attack tool, so POC availability should not be treated as confirmed. The quadratic-parsing mechanism is well-documented and the payload is trivial to construct ('.a.a.a...'), which argues the bug is genuinely reproducible, but the narrow precondition (runtime parsing of untrusted selectors) sharply limits the real-world exploitable population. Net: a credible single-core DoS for the small subset of services that expose selector parsing to untrusted input, and effectively a non-issue for the large majority of consumers that parse only trusted CSS at build time. No key signals are directly conflicting, but the absence of EPSS/KEV/SSVC data means exploitation likelihood cannot be quantified from the input.

An application exposes an HTTP endpoint that accepts user-supplied CSS selectors and parses them synchronously with postcss-selector-parser (for example a theming, CSS-sanitization, or query-builder feature). An unauthenticated attacker submits a single long flat selector such as '.a' repeated tens of thousands of times, triggering quadratic scanning in splitWord()/uniqs() and pinning a parser thread, degrading or denying service for other users. No public weaponized exploit is provided, but the fix's own complexity tests demonstrate the payload shape (a repeated atom as one word token).