CVE catalog
CVE-2026-9358
A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a ma
- Severity
- Medium · CVSS 4.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.33% · Oct 25, 2026
A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 6.1.3 and 7.1.3 is able to address this issue. This patch is called 5bc698cef66f8abd12610dc623e5d67cbc0f869d. It is suggested to upgrade the affected component. The vendor explains, that according to his definition "DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS)." The commits were backported to 6.x branch, which was the most downloaded version.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | node-css-loader | sid | 6.11.0+~cs15.5.7-3 | fixed |
| Debian | node-css-loader | forky | 6.11.0+~cs15.5.7-3 | fixed |
| Debian | node-css-loader | trixie | 6.8.1+~cs14.0.17-1 | vulnerable |
| Debian | node-css-loader | bookworm | 6.7.2+~cs14.0.11-1 | vulnerable |
| Cpe | node-css-loader | Not reported | Not reported | vulnerable |
| Npm | postcss-selector-parser | Not reported | 7.1.3 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | node-css-loader | source | sid | 6.8.1+~cs14.1.4-1 | not yet assigned | Not reported | [1139161] |
| Debian | node-css-loader | source | forky | 6.8.1+~cs14.1.4-1 | not yet assigned | Not reported | [1139161] |
| Debian | node-css-loader | source | trixie | (unfixed) | not yet assigned | Not reported | [1139161] |
| Debian | node-css-loader | source | bookworm | (unfixed) | not yet assigned | Not reported | [1139161] |
| Npm | postcss-selector-parser | npm | Not reported | 7.1.3 | Not reported | GHSA-W9M9-85WC-3X92 | Not reported |
Notes
[trixie] node-css-loader: Minor issue [bookworm] node-css-loader: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [node-css-loader]Affected
Details (2)
6.7.2+~cs14.0.11-1· all · bookwormAffected
nvd · node-css-loader · debian · bookworm; nvd · node-css-loader · debian · 12
6.7.2+~cs14.0.11-1· all · bookwormAffected
nvd · node-css-loader · debian · bookworm; nvd · node-css-loader · debian · 12
[Debian 13 (Trixie)]
- [node-css-loader]Affected
Details (2)
6.8.1+~cs14.0.17-1· all · trixieAffected
nvd · node-css-loader · debian · 13
6.8.1+~cs14.0.17-1· all · trixieAffected
nvd · node-css-loader · debian · 13
Observed:
References
- [https://nvd.nist.gov/vuln/detail/CVE-2026-9358]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-9358]
- [https://osv.dev/vulnerability/GHSA-w9m9-85wc-3x92]
- [https://security-tracker.debian.org/tracker/CVE-2026-9358]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9358.json]
[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]