CVE-2026-104844

A flaw was found in postcss-selector-parser. A remote attacker could exploit this vulnerability by submitting a specially crafted CSS selector containing numerous class or ID identifiers to an application that parses untrusted input. Due to inefficient processing and repeated scanning during selector parsing, handling these inputs requires quadratic computational effort. This can exhaust CPU resources and stall the synchronous parser thread, resulting in a Denial of Service (DoS).