Vulnerable Library - postcss-8.5.14.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/postcss-npm-8.5.14-1cf8d01c78-10c0.zip
Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-73646
Vulnerable Library - postcss-8.5.14.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/postcss-npm-8.5.14-1cf8d01c78-10c0.zip
Dependency Hierarchy:
- ❌ postcss-8.5.14.tgz (Vulnerable Library)
Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be
Found in base branch: main
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.
Publish Date: 2026-08-17
URL: CVE-2026-73646
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-13
Fix Resolution: https://github.com/postcss/postcss.git - 8.5.18
Step up your Open Source Security Game with Mend here
CVE-2026-73086
Vulnerable Library - nanoid-3.3.11.tgz
A tiny (116 bytes), secure URL-friendly unique string ID generator
Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/nanoid-npm-3.3.11-f98c1f9ef6-10c0.zip
Dependency Hierarchy:
- postcss-8.5.14.tgz (Root Library)
- ❌ nanoid-3.3.11.tgz (Vulnerable Library)
Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be
Found in base branch: main
Vulnerability Details
nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.
Publish Date: 2026-08-11
URL: CVE-2026-73086
CVSS 3 Score Details (7.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-xwg4-73v4-xw9w
Release Date: 2026-08-11
Fix Resolution (nanoid): 3.3.12
Direct dependency fix Resolution (postcss): 8.5.15
Step up your Open Source Security Game with Mend here
CVE-2026-67214
Vulnerable Library - nanoid-3.3.11.tgz
A tiny (116 bytes), secure URL-friendly unique string ID generator
Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/nanoid-npm-3.3.11-f98c1f9ef6-10c0.zip
Dependency Hierarchy:
- postcss-8.5.14.tgz (Root Library)
- ❌ nanoid-3.3.11.tgz (Vulnerable Library)
Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be
Found in base branch: main
Vulnerability Details
nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
Publish Date: 2026-07-29
URL: CVE-2026-67214
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-07-29
Fix Resolution: https://github.com/ai/nanoid.git - 5.1.16
Step up your Open Source Security Game with Mend here
CVE-2026-67213
Vulnerable Library - nanoid-3.3.11.tgz
A tiny (116 bytes), secure URL-friendly unique string ID generator
Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/nanoid-npm-3.3.11-f98c1f9ef6-10c0.zip
Dependency Hierarchy:
- postcss-8.5.14.tgz (Root Library)
- ❌ nanoid-3.3.11.tgz (Vulnerable Library)
Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be
Found in base branch: main
Vulnerability Details
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
Publish Date: 2026-07-29
URL: CVE-2026-67213
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-07-29
Fix Resolution: https://github.com/ai/nanoid.git - 5.1.6
Step up your Open Source Security Game with Mend here
CVE-2026-69153
Vulnerable Library - postcss-8.5.14.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/postcss-npm-8.5.14-1cf8d01c78-10c0.zip
Dependency Hierarchy:
- ❌ postcss-8.5.14.tgz (Vulnerable Library)
Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be
Found in base branch: main
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Publish Date: 2026-08-03
URL: CVE-2026-69153
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-03
Fix Resolution: https://github.com/postcss/postcss.git - 8.5.23
Step up your Open Source Security Game with Mend here
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/postcss-npm-8.5.14-1cf8d01c78-10c0.zip
Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - postcss-8.5.14.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/postcss-npm-8.5.14-1cf8d01c78-10c0.zip
Dependency Hierarchy:
Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be
Found in base branch: main
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.
Publish Date: 2026-08-17
URL: CVE-2026-73646
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-08-13
Fix Resolution: https://github.com/postcss/postcss.git - 8.5.18
Step up your Open Source Security Game with Mend here
Vulnerable Library - nanoid-3.3.11.tgz
A tiny (116 bytes), secure URL-friendly unique string ID generator
Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/nanoid-npm-3.3.11-f98c1f9ef6-10c0.zip
Dependency Hierarchy:
Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be
Found in base branch: main
Vulnerability Details
nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.
Publish Date: 2026-08-11
URL: CVE-2026-73086
CVSS 3 Score Details (7.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-xwg4-73v4-xw9w
Release Date: 2026-08-11
Fix Resolution (nanoid): 3.3.12
Direct dependency fix Resolution (postcss): 8.5.15
Step up your Open Source Security Game with Mend here
Vulnerable Library - nanoid-3.3.11.tgz
A tiny (116 bytes), secure URL-friendly unique string ID generator
Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/nanoid-npm-3.3.11-f98c1f9ef6-10c0.zip
Dependency Hierarchy:
Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be
Found in base branch: main
Vulnerability Details
nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
Publish Date: 2026-07-29
URL: CVE-2026-67214
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-07-29
Fix Resolution: https://github.com/ai/nanoid.git - 5.1.16
Step up your Open Source Security Game with Mend here
Vulnerable Library - nanoid-3.3.11.tgz
A tiny (116 bytes), secure URL-friendly unique string ID generator
Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/nanoid-npm-3.3.11-f98c1f9ef6-10c0.zip
Dependency Hierarchy:
Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be
Found in base branch: main
Vulnerability Details
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
Publish Date: 2026-07-29
URL: CVE-2026-67213
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-07-29
Fix Resolution: https://github.com/ai/nanoid.git - 5.1.6
Step up your Open Source Security Game with Mend here
Vulnerable Library - postcss-8.5.14.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/postcss-npm-8.5.14-1cf8d01c78-10c0.zip
Dependency Hierarchy:
Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be
Found in base branch: main
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Publish Date: 2026-08-03
URL: CVE-2026-69153
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-08-03
Fix Resolution: https://github.com/postcss/postcss.git - 8.5.23
Step up your Open Source Security Game with Mend here