Skip to main content
cve.nowby Sazabi
← npm
npmPackage

postcss

7 known vulnerabilities (2 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
8.5.32 (Oct 26, 2026): no advisory affects it
Newest unaffected release
8.5.32 (Oct 26, 2026), the latest release
Advisories
7 · 2 high, 4 medium
Weekly downloads
404.8M
Dependents
215K
Releases
296 since 0.1.0 (Nov 4, 2013)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-73646
    Affects 0.1.0 to 8.5.17 (8.5.18 is outside it)
  • CVE-2026-69153
    Affects 0.1.0 to 8.5.22 (8.5.23 is outside it)
  • CVE-2026-45623
    Affects 0.1.0 to 8.5.11 (8.5.12 is outside it)
  • CVE-2026-41305
    Affects 0.1.0 to 8.5.9 (8.5.10 is outside it)
  • CVE-2023-44270
    Affects 0.1.0 to 8.4.30 (8.4.31 is outside it)
  • CVE-2021-23382
    Affects 0.1.0 to 7.0.35 (7.0.36 is outside it); 8.0.0 to 8.2.12 (8.2.13 is outside it)
  • CVE-2021-23368
    Affects 7.0.0 to 7.0.35 (7.0.36 is outside it); 8.0.0 to 8.2.9 (8.2.10 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 7

  • PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

    Affected: fixed in 8.5.18.

    Fixed in 8.5.18 (released Jul 12, 2026, 36 days before disclosure).

    The latest release, 8.5.32, is not affected.

    41% of postcss downloads last week were affected versions (184.9M).

  • CVE-2026-69153Medium 6.3

    PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

    Affected: fixed in 8.5.23.

    Fixed in 8.5.23 (released Jul 24, 2026, 10 days before disclosure).

    The latest release, 8.5.32, is not affected.

    43% of postcss downloads last week were affected versions (194M).

  • PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

    Affected: fixed in 8.5.12.

    Fixed in 8.5.12 (released Apr 26, 2026, 92 days before disclosure).

    The latest release, 8.5.32, is not affected.

    34% of postcss downloads last week were affected versions (153.8M).

  • CVE-2026-41305Medium 6.1

    PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

    Affected: fixed in 8.5.10.

    Fixed in 8.5.10 (released Apr 15, 2026, 9 days before disclosure).

    The latest release, 8.5.32, is not affected.

    33% of postcss downloads last week were affected versions (149.1M).

  • An issue was discovered in PostCSS before 8.4.31.

    Affected: fixed in 8.4.31.

    Fixed in 8.4.31 (released Sep 28, 2023, 1 day before disclosure).

    The latest release, 8.5.32, is not affected.

    11% of postcss downloads last week were affected versions (47.9M).

  • CVE-2021-23382Medium 5.3

    Regular Expression Denial of Service (ReDoS)

    Affected: from 8.0.0, fixed in 8.2.13; fixed in 7.0.36.

    Fixed in 7.0.36 (released Jun 11, 2021, 46 days after disclosure) and 8.2.13 (released Apr 26, 2021, the day of disclosure).

    The latest release, 8.5.32, is not affected.

    3.9% of postcss downloads last week were affected versions (17.8M).

  • CVE-2021-23368Medium 5.3

    Regular Expression Denial of Service (ReDoS)

    Affected: from 7.0.0, fixed in 7.0.36; from 8.0.0, fixed in 8.2.10.

    Fixed in 7.0.36 (released Jun 11, 2021, 60 days after disclosure) and 8.2.10 (released Apr 11, 2021, 1 day before disclosure).

    The latest release, 8.5.32, is not affected.

    1.2% of postcss downloads last week were affected versions (5.5M).