The vulnerability in postcss-selector-parser arises because the splitWord() function treats flat selectors containing many class or ID indexes as a single word token, since period and hash characters are not treated as word delimiters. This causes multiple passes—uniqs() deduplication, class and ID membership checks, and Sass-interpolation filtering—to repeatedly scan large arrays, resulting in quadratic time complexity relative to the number of indexes. An attacker can craft selectors that exploit this inefficiency to consume excessive CPU resources synchronously, leading to denial of service. The maxNestingDepth guard does not prevent this because the malicious selector can have zero nesting depth. Only consumers that synchronously parse untrusted selectors in exposed request paths are vulnerable. The issue is resolved in version 7.1.6.

An attacker can cause a denial of service by submitting specially crafted CSS selectors that trigger excessive CPU consumption during synchronous parsing. This impacts availability but does not affect confidentiality or integrity. The vulnerability only affects environments that parse untrusted selectors synchronously in exposed request paths, not typical build-time parsing of trusted sources.

Upgrade postcss-selector-parser to version 7.1.6 or later where this issue is fixed. If upgrading is not immediately possible, avoid synchronously parsing untrusted selectors in exposed request paths to mitigate the risk.