npm package
postcss vulnerabilities by version
The latest release, 8.5.30 (Oct 12, 2026), has no known vulnerabilities. 46% of last week’s 308.2M downloads went to versions with known vulnerabilities. OSV.dev lists 7 advisories for postcss; the newest was published on Aug 3, 2026.
npm (opens in a new tab) describes it as “Tool for transforming styles with JS plugins”
- Latest release
- 8.5.30
- Oct 12, 2026, no known vulnerabilities
- Downloads last week
- 308.2M
- All versions, from npm
- Advisories on OSV.dev
- 7
- Newest Aug 3, 2026
- Licence
- MIT
Most-downloaded versions last week
From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.
Who is still on a vulnerable postcss
46% of last week’s 308.2M postcss downloads went to versions with known vulnerabilities.
From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.
Release lines
The newest release of each major line, from the registry. postcss doesn’t publish support dates we can check.
Newest advisories
The 5 most recently published, with the versions each one affects.
WarningCVE-2026-69153 on OSV.dev (opens in a new tab)GHSA-fxqj-rqcc-2cmp
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
Affects < 8.5.23. Published Aug 3, 2026.
CriticalCVE-2026-73646 on OSV.dev (opens in a new tab)GHSA-r28c-9q8g-f849
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
Affects < 8.5.18. Published Jul 24, 2026.
CriticalCVE-2026-45623 on OSV.dev (opens in a new tab)GHSA-6g55-p6wh-862q
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
Affects < 8.5.12. Published Jul 23, 2026.
WarningCVE-2026-41305 on OSV.dev (opens in a new tab)GHSA-qx2v-qp2m-jg93
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
Affects < 8.5.10. Published Apr 24, 2026.
WarningCVE-2023-44270 on OSV.dev (opens in a new tab)GHSA-7fh5-64p2-3v2j
PostCSS line return parsing error
Affects < 8.4.31. Published Sep 30, 2023.
All 7 advisories are on OSV.dev (opens in a new tab).
Which postcss do you have?
Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.
How this page is checked
StackPrism reads every OSV.dev advisory for postcss, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.