Postcss Selector Parser
Monthly
A crafted flat CSS selector can stall a synchronous parser thread in postcss-selector-parser versions prior to 7.1.6, because class and ID index lists are scanned repeatedly inside parsing passes that should be linear, producing quadratic (O(n^2)) parse cost. Only consumers that synchronously parse untrusted selector strings on an exposed request path are affected; the vendor explicitly notes ordinary build-time parsing of trusted sources is not affected. The issue is remotely triggerable by unauthenticated attackers where that precondition holds (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.9), is availability-only with no confidentiality or integrity impact, and there is no public exploit code and no confirmed active exploitation (no KEV listing) at time of analysis. A vendor-released patch, version 7.1.6, is available.
A crafted flat CSS selector can stall a synchronous parser thread in postcss-selector-parser versions prior to 7.1.6, because class and ID index lists are scanned repeatedly inside parsing passes that should be linear, producing quadratic (O(n^2)) parse cost. Only consumers that synchronously parse untrusted selector strings on an exposed request path are affected; the vendor explicitly notes ordinary build-time parsing of trusted sources is not affected. The issue is remotely triggerable by unauthenticated attackers where that precondition holds (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.9), is availability-only with no confidentiality or integrity impact, and there is no public exploit code and no confirmed active exploitation (no KEV listing) at time of analysis. A vendor-released patch, version 7.1.6, is available.