postcss (npm)

Transforming styles with JS plugins

Advisories

Latest version

8.5.32

Released Oct 26, 2026

License

MIT

OpenSSF Scorecard

7.5 / 10

How to fix

Upgrading to 8.5.23 or later clears every advisory below that has a fix.

Upgrade commands

npm

npm install postcss@8.5.32

yarn

yarn add postcss@8.5.32

pnpm

pnpm add postcss@8.5.32

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-fxqj-rqcc-2cmp PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset	Medium EPSS 0.45%	`< 8.5.23`	`8.5.23`
GHSA-fxqj-rqcc-2cmp PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset	Medium EPSS 0.45%	`<= 8.5.22`	No fix yet
GHSA-r28c-9q8g-f849 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure	High EPSS 0.53%	`<= 8.5.17`	No fix yet
GHSA-r28c-9q8g-f849 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure	High EPSS 0.53%	`< 8.5.18`	`8.5.18`
GHSA-6g55-p6wh-862q PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments	Critical EPSS 0.61%	`< 8.5.12`	`8.5.12`
GHSA-6g55-p6wh-862q PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments	Critical EPSS 0.61%	`<= 8.5.11`	No fix yet
GHSA-qx2v-qp2m-jg93 PostCSS has XSS via Unescaped </style> in its CSS Stringify Output	Medium EPSS 0.21%	`< 8.5.10`	`8.5.10`
GHSA-qx2v-qp2m-jg93 PostCSS has XSS via Unescaped </style> in its CSS Stringify Output	Medium EPSS 0.21%	`< 8.5.10`	`8.5.10`
GHSA-7fh5-64p2-3v2j PostCSS line return parsing error	Medium EPSS 0.97%	`< 8.4.31`	`8.4.31`
GHSA-7fh5-64p2-3v2j PostCSS line return parsing error	Medium EPSS 0.97%	`< 8.4.31`	`8.4.31`
GHSA-566m-qj78-rww5 Regular Expression Denial of Service in postcss	High EPSS 2.56%	`< 7.0.36`	`7.0.36`
GHSA-566m-qj78-rww5 Regular Expression Denial of Service in postcss	High EPSS 2.56%	`>= 8.0.0, < 8.2.13`	`8.2.13`
GHSA-hwj9-h5mp-3pm3 Regular Expression Denial of Service in postcss	Medium EPSS 3.51%	`>= 7.0.0, < 7.0.36`	`7.0.36`
GHSA-hwj9-h5mp-3pm3 Regular Expression Denial of Service in postcss	Medium EPSS 3.51%	`>= 8.0.0, < 8.2.10`	`8.2.10`

Source: git+https://github.com/postcss/postcss.git

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor