Repository navigation
[GHSA-rj75-hqrm-r3gf] PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion - #10457
Conversation
|
Hi there @MoOx! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
There was a problem hiding this comment.
🔵 Needs a closer look
The upstream backport is confirmed, but the npm-published 6.1.5 artifact remains unverified before narrowing security coverage.
No open issues 🎉
What changed in this PR
Updates the postcss-selector-parser advisory to recognize the 6.x security backport and correct remediation guidance.
Changes:
- Separates affected ranges, identifying fixes in 6.1.5 and 7.1.6.
- Documents the backport and adds supporting references.
| File | Description |
|---|---|
| advisories/github-reviewed/2026/10/GHSA-rj75-hqrm-r3gf/GHSA-rj75-hqrm-r3gf.json | Updates affected ranges, patch guidance, and references. |
Review effort: Max
|
This looks like a dup of #10456 |
Updates
Comments
6.1.5 patches the 6.x line. The fix from 62b1917 (7.1.6) was backported to the 6.x.x branch in postcss/postcss-selector-parser#346 (merged 2026-10-19 as 70b0779c843462197380d25daa02d1528bf7eae5) and released as 6.1.5 the same day (version commit d90b6e38a0c79d07b02bf0d602bc242fe94be6b9, release https://github.com/postcss/postcss-selector-parser/releases/tag/6.1.5, npm https://www.npmjs.com/package/postcss-selector-parser/v/6.1.5).
The current single range "< 7.1.6" leaves every 6.x version without a patched version, so dependants on ^6 (tailwindcss 3, postcss-nested 6) keep an open Dependabot alert after updating to 6.1.5. Suggested ranges: "< 6.1.5" patched in 6.1.5, and ">= 7.0.0, < 7.1.6" patched in 7.1.6, mirroring the two-range layout of GHSA-w9m9-85wc-3x92 for the same package.