# postcss (npm) vulnerabilities 7 known vulnerabilities (2 high, 4 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 8.5.32 (Oct 26, 2026): no advisory affects it - Newest unaffected release: 8.5.32 (Oct 26, 2026), the latest release - Weekly downloads: 404.8M - Dependents: 215K - Releases: 296 since 0.1.0 (Nov 4, 2013) - Registry: https://www.npmjs.com/package/postcss - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-73646: 0.1.0 to 8.5.17 (8.5.18 is outside it) - CVE-2026-69153: 0.1.0 to 8.5.22 (8.5.23 is outside it) - CVE-2026-45623: 0.1.0 to 8.5.11 (8.5.12 is outside it) - CVE-2026-41305: 0.1.0 to 8.5.9 (8.5.10 is outside it) - CVE-2023-44270: 0.1.0 to 8.4.30 (8.4.31 is outside it) - CVE-2021-23382: 0.1.0 to 7.0.35 (7.0.36 is outside it); 8.0.0 to 8.2.12 (8.2.13 is outside it) - CVE-2021-23368: 7.0.0 to 7.0.35 (7.0.36 is outside it); 8.0.0 to 8.2.9 (8.2.10 is outside it) ## Advisories (7) ### [CVE-2026-73646](https://cve.now/CVE-2026-73646): PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure - Severity: High 7.5 - Published: Aug 17, 2026 - Affected: fixed in 8.5.18. - Fixed in 8.5.18 (released Jul 12, 2026, 36 days before disclosure). - The latest release, 8.5.32, is not affected. - 41% of postcss downloads last week were affected versions (184.9M). ### [CVE-2026-69153](https://cve.now/CVE-2026-69153): PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when \`from\` is unset - Severity: Medium 6.3 - Published: Aug 3, 2026 - Affected: fixed in 8.5.23. - Fixed in 8.5.23 (released Jul 24, 2026, 10 days before disclosure). - The latest release, 8.5.32, is not affected. - 43% of postcss downloads last week were affected versions (194M). ### [CVE-2026-45623](https://cve.now/CVE-2026-45623): PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments - Severity: High 7.5 - Published: Jul 27, 2026 - Affected: fixed in 8.5.12. - Fixed in 8.5.12 (released Apr 26, 2026, 92 days before disclosure). - The latest release, 8.5.32, is not affected. - 34% of postcss downloads last week were affected versions (153.8M). ### [CVE-2026-41305](https://cve.now/CVE-2026-41305): PostCSS has XSS via Unescaped \ in its CSS Stringify Output - Severity: Medium 6.1 - Published: Apr 24, 2026 - Affected: fixed in 8.5.10. - Fixed in 8.5.10 (released Apr 15, 2026, 9 days before disclosure). - The latest release, 8.5.32, is not affected. - 33% of postcss downloads last week were affected versions (149.1M). ### [CVE-2023-44270](https://cve.now/CVE-2023-44270): An issue was discovered in PostCSS before 8.4.31. - Severity: Unrated - Published: Sep 29, 2023 - Affected: fixed in 8.4.31. - Fixed in 8.4.31 (released Sep 28, 2023, 1 day before disclosure). - The latest release, 8.5.32, is not affected. - 11% of postcss downloads last week were affected versions (47.9M). ### [CVE-2021-23382](https://cve.now/CVE-2021-23382): Regular Expression Denial of Service (ReDoS) - Severity: Medium 5.3 - Published: Apr 26, 2021 - Affected: from 8.0.0, fixed in 8.2.13; fixed in 7.0.36. - Fixed in 7.0.36 (released Jun 11, 2021, 46 days after disclosure) and 8.2.13 (released Apr 26, 2021, the day of disclosure). - The latest release, 8.5.32, is not affected. - 3.9% of postcss downloads last week were affected versions (17.8M). ### [CVE-2021-23368](https://cve.now/CVE-2021-23368): Regular Expression Denial of Service (ReDoS) - Severity: Medium 5.3 - Published: Apr 12, 2021 - Affected: from 7.0.0, fixed in 7.0.36; from 8.0.0, fixed in 8.2.10. - Fixed in 7.0.36 (released Jun 11, 2021, 60 days after disclosure) and 8.2.10 (released Apr 11, 2021, 1 day before disclosure). - The latest release, 8.5.32, is not affected. - 1.2% of postcss downloads last week were affected versions (5.5M). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/postcss Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.