CVE-2026-104844: 
JavaScript vulnerability analysis and mitigation

CVE-2026-104844 is a quadratic complexity denial-of-service vulnerability in PostCSS Selector Parser (postcss-selector-parser), a widely used CSS selector parsing library. The flaw exists in all versions prior to 7.1.6 and allows an unauthenticated remote attacker to craft a CSS selector that causes excessive CPU consumption, blocking the synchronous parser thread. It was reported by Wayde Shi, published by the maintainer on September 3, 2026, and assigned a CVSS v3.1 base score of 5.9 (Medium) (Github Advisory, Red Hat).

The root cause is inefficient algorithmic complexity (CWE-407) leading to uncontrolled resource consumption (CWE-400). In src/parser.js, the splitWord() function receives flat selectors (e.g., .a.a.a...) as a single word token because . (period) and # (hash) characters are not treated as word delimiters by the tokenizer. This causes three internal passes — uniqs() deduplication, the indices.forEach membership check loop, and the Sass-interpolation filter — to each scan the class/ID index arrays linearly for every index, resulting in O(n²) time complexity relative to the number of indexes. A 400 KB crafted flat selector took approximately 34 seconds to parse on a modern laptop, while a benign selector of identical byte size parsed in tens of milliseconds. The existing maxNestingDepth guard introduced in 7.1.3 provides no protection because the malicious selector has zero nesting depth (Github Advisory, Patch Commit).

Successful exploitation causes a complete availability impact on any service that synchronously parses untrusted CSS selectors in a request path, such as CSS sanitizers, CSS-in-JS services, and online playgrounds. A crafted selector can fully occupy a single synchronous parser thread, preventing legitimate requests from being processed and effectively causing a denial of service. There is no confidentiality or integrity impact; data exposure and lateral movement are not applicable to this vulnerability (Github Advisory, Red Hat).

No public proof-of-concept exploit code or in-the-wild exploitation has been observed as of the time of this report (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified. The EPSS score is approximately 0.394% (32nd percentile), indicating a low near-term probability of exploitation. Exploitation requires high attack complexity, as the attacker must be able to supply untrusted CSS selectors to a synchronous parsing endpoint — a condition that is deployment-dependent and not universally present (Github Advisory).

1. Identify a vulnerable target: Locate a web service or application that uses postcss-selector-parser < 7.1.6 and synchronously parses user-supplied CSS selectors in a request path (e.g., a CSS sanitizer API, CSS-in-JS service, or online CSS playground).
2. Craft a malicious selector: Construct a large flat CSS selector consisting of many repeated class or ID segments without spaces, such as .a.a.a.a... (repeated tens of thousands of times) or #a#a#a..., to maximize the number of class/ID indexes in a single word token. A payload of approximately 400 KB is sufficient to cause ~34 seconds of CPU occupancy.
3. Submit the payload: Send the crafted selector as input to the vulnerable parsing endpoint via an HTTP request (e.g., a POST body or query parameter accepted by the CSS processing service).
4. Achieve denial of service: The parser's splitWord() function processes the payload with O(n²) complexity, fully occupying the synchronous parser thread and preventing the service from handling legitimate requests for the duration of parsing (Github Advisory, Patch Commit).

• Network: Unusually large HTTP requests (e.g., POST bodies or query parameters exceeding tens or hundreds of kilobytes) containing CSS selector strings with long sequences of repeated . or # characters sent to CSS parsing endpoints.
• Process/Performance: Sustained high CPU utilization (near 100% on a single core) in the Node.js process hosting the vulnerable service, correlated with incoming requests to CSS parsing functionality; event loop lag or request timeouts in application performance monitoring.
• Logs: Application logs showing requests that take abnormally long to process (tens of seconds) or time out on CSS parsing endpoints; access logs with large Content-Length values targeting selector-processing routes.

Upgrade postcss-selector-parser to version 7.1.6 or later, which replaces the quadratic array-scanning passes with O(1) Set membership tests, making parsing linear in the number of indexes with no behavioral change to parsing output (Release 7.1.6, Patch Commit). As a workaround if immediate upgrade is not possible, cap the maximum byte size of CSS selectors accepted from untrusted sources before passing them to the parser, and avoid exposing synchronous selector parsing to user-supplied input in request paths. Consider implementing request timeouts or using asynchronous parsing with resource limits for any user-facing CSS processing functionality (Github Advisory).