postcss

8.5.31 · 18 Oct 2026MIT188.6M / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Is your project affected?

Paste your package.json, or type the range you declare for postcss. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	8.5.31	Safe from 8.5.23
	7.0.39	59 open advisories, worst high · last release Oct 2021, no longer updated

Your version

High
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File DisclosureGHSA-r28c-9q8g-f849 · 24 Jul 2026
- 8.x8.0.0 – 8.5.17Fixed in 8.5.18
- 7.x and older0.1.0 – 7.0.39No fix, no longer updated · move to 8.5.18
High
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS commentsGHSA-6g55-p6wh-862q · 23 Jul 2026
- 8.x8.0.0 – 8.5.11Fixed in 8.5.12
- 7.x and older0.1.0 – 7.0.39No fix, no longer updated · move to 8.5.12
Moderate
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unsetGHSA-fxqj-rqcc-2cmp · 3 Aug 2026
- 8.x8.0.0 – 8.5.22Fixed in 8.5.23
- 7.x and older0.1.0 – 7.0.39No fix, no longer updated · move to 8.5.23
Moderate
PostCSS has XSS via Unescaped </style> in its CSS Stringify OutputGHSA-qx2v-qp2m-jg93 · 24 Apr 2026
- 8.x8.0.0 – 8.5.9Fixed in 8.5.10
- 7.x and older0.1.0 – 7.0.39No fix, no longer updated · move to 8.5.10
Moderate
PostCSS line return parsing errorGHSA-7fh5-64p2-3v2j · 30 Sep 2023
- 8.x8.0.0 – 8.4.30Fixed in 8.4.31
- 7.x and older0.1.0 – 7.0.39No fix, no longer updated · move to 8.4.31
Moderate
Regular Expression Denial of Service in postcssGHSA-566m-qj78-rww5 · 7 Jan 2022
- 8.x8.0.0 – 8.2.12Fixed in 8.2.13
- 7.x7.0.0 – 7.0.35Fixed in 7.0.36
- 6.x and older0.1.0 – 6.0.23No fix, no longer updated · move to 7.0.36
Moderate
Regular Expression Denial of Service in postcssGHSA-hwj9-h5mp-3pm3 · 10 May 2021
- 8.x8.0.0 – 8.2.9Fixed in 8.2.10
- 7.x7.0.0 – 7.0.35Fixed in 7.0.36

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.