CVE-2026-45623 is a file disclosure flaw in PostCSS 8.5.11 and earlier, rated 7.5 (high) in NVD. A sourceMappingURL comment in untrusted CSS makes PostCSS read a local file and leak its first bytes in an error. The fix is PostCSS 8.5.12.
What's affected
PostCSS 8.5.11 and earlier is affected. Version 8.5.12 fixes it. The record notes the behavior appears with default options: no from, no map and no plugins are needed.
That makes the real question about your pipeline, not your version alone. The record lists examples of exposed setups: CMS themes, user-uploaded styles, userstyle processors, build pipelines for third-party packages and comment renderers. If only your own trusted CSS goes through PostCSS, the practical risk is much lower.
How to check if you're exposed
PostCSS is usually a transitive dependency, so check the whole tree.
npm ls postcss
yarn why postcss
pnpm why postcss
Every copy at 8.5.11 or earlier needs attention. Then answer one more question: does any code path run CSS written by someone you do not trust? If it does, and PostCSS errors reach users or logs they can read, treat the issue as live.
What to do now
- List every PostCSS version in each project, including nested copies under bundlers and frameworks.
- Upgrade to 8.5.12 or later. Use overrides or resolutions if a parent package pins an older copy.
- If you cannot upgrade yet, the advisory says passing
{ map: false }disables the bug, at the cost of in-memory previous-map handling. - Do not show raw PostCSS error messages to end users.
- Review any app that already surfaced PostCSS errors to users, since file contents could have leaked that way.
Why it matters
Two weakness classes apply: CWE-22, path traversal, and CWE-200, exposure of sensitive information. The path in the comment is used against the local filesystem with no scheme, allowlist or traversal check.
The leak is small, about the first ten bytes of a file, shown in a JSON parse error. The record also says it works as a precise file existence check and can be pointed at large files to cause denial of service. The KEV flag is false.
Try it yourself
Finding every nested copy of a package is the hard part of this fix. This demo shows how an inventory answers that.
Click through it at your own pace, or open it full screen.
Quick check
Does npm audit fix solve this?
It can, if a patched 8.5.12 satisfies every range in your tree. Run npm ls postcss afterward to confirm no older copy remains.
Sources
Last reviewed: 19 October 2026.
