postcss
NPM Package
Vulnerability Check
Tool for transforming styles with JS plugins
postcss
Advisory Breakdown
Severity Rating
High severity7 advisories
High severity
Weekly downloads
271,618,690
Total advisories
7
Latest version
8.5.26
License
MIT
Known advisories
OSV records for the npm ecosystem
Regular Expression Denial of Service in postcss
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
PostCSS line return parsing error
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
Regular Expression Denial of Service in postcss
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
Checked Aug 12, 2026, 7:45 PM from npm and OSV.dev
Package metadata
From the npm registry
- Package name
- postcss
- Ecosystem
- npm
- Latest version
- 8.5.26
- License
- MIT
- Weekly downloads
- 271,618,690
- Repository
- Open repository
Remediation boundary
What RequestGuard does — and doesn't — cover
RequestGuard does not fix npm package vulnerabilities. Dependency remediation happens through package updates, patches, lockfile changes, and maintainer guidance. RequestGuard can help mitigate runtime abuse around exposed web and API flows while remediation is handled separately.
Data from npm registry and OSV.dev · Checked 8/12/2026, 7:45:01 PM