Hi,

The following vulnerability was published for node-css-loader.

CVE-2026-9358[0]:
| A vulnerability was determined in postcss up to 7.1.1. Affected is
| the function toString of the file src/selectors/container.js of the
| component AST Serialization. Executing a manipulation can lead to
| uncontrolled recursion. It is possible to launch the attack
| remotely. The exploit has been publicly disclosed and may be
| utilized. The vendor explains, that according to his definition "DoS
| on server-side on user-generated CSS is low risk for us (since most
| users compile own CSS with PostCSS)."


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-9358
https://www.cve.org/CVERecord?id=CVE-2026-9358
[1] https://gist.github.com/bx33661/581e3a38134601c04e19b4dfc9b459b9

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hello,

Bug #1139161 in node-css-loader reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-css-loader/-/commit/dd9e2eddc2ad325eb9d1c0da7f77ce70951f00a2

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1139161

Hello,

Bug #1139161 in node-css-loader reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-css-loader/-/commit/dd9e2eddc2ad325eb9d1c0da7f77ce70951f00a2

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1139161

We believe that the bug you reported is fixed in the latest version of
node-css-loader, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1139161@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Xavier Guimard <yadd@debian.org> (supplier of updated node-css-loader package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 24 Jun 2026 10:22:50 +0200
Source: node-css-loader
Architecture: source
Version: 6.8.1+~cs14.1.4-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed-By: Xavier Guimard <yadd@debian.org>
Closes: 1139161
Changes:
 node-css-loader (6.8.1+~cs14.1.4-1) unstable; urgency=medium
 .
   * Team upload
   * Declare compliance with policy 4.7.4
   * debian/watch version 5
   * New upstream vrsion (Closes: #1139161, CVE-2026-9358)
   * Build postcss-selector-parser with tsc
Checksums-Sha1:
 bf41c6f13049d945de8d4f58a9591db3a7fd4202 3890 node-css-loader_6.8.1+~cs14.1.4-1.dsc
 f30f716c8e2bd346c7b67d3df3915566a7c05607 1579 node-css-loader_6.8.1+~cs14.1.4.orig-indexes-of.tar.gz
 cb23092a4013eed363de9b567b4db4d0e07c8949 97013 node-css-loader_6.8.1+~cs14.1.4.orig-postcss-modules-local-by-default.tar.gz
 207f3b571ae1c0622b7c2609d2c55bbc08d15107 82836 node-css-loader_6.8.1+~cs14.1.4.orig-postcss-modules-scope.tar.gz
 14a4eaf14c1fb809547fb09ed7b1de4b2688ff44 70080 node-css-loader_6.8.1+~cs14.1.4.orig-postcss-selector-parser.tar.gz
 47bcbab5d126e2c31d961ce29d8279a6c70931a0 12946847 node-css-loader_6.8.1+~cs14.1.4.orig.tar.gz
 51d3d8becd1193511c68149fbba2054fcc399993 5328 node-css-loader_6.8.1+~cs14.1.4-1.debian.tar.xz
Checksums-Sha256:
 17801eb9506868a73c033a4c01d7d93b556cc90812c99c4a833f2da307bc697f 3890 node-css-loader_6.8.1+~cs14.1.4-1.dsc
 08bb4baab18402b90895eab57e721b94839fb799572f66ff5a1fd1a6b8425862 1579 node-css-loader_6.8.1+~cs14.1.4.orig-indexes-of.tar.gz
 750db826c6acd7e430b292282e0e3d750e6d5dadfc405004ca688f72d0f8bdab 97013 node-css-loader_6.8.1+~cs14.1.4.orig-postcss-modules-local-by-default.tar.gz
 37bf7bc1555cb90fcfeee7df3d2c7e9c731ab216af40347ae3f1d00d70d40e1b 82836 node-css-loader_6.8.1+~cs14.1.4.orig-postcss-modules-scope.tar.gz
 18c560b47b3e4c6cce9b0acdafa9662526d30b827563688db274c9c39498b4e3 70080 node-css-loader_6.8.1+~cs14.1.4.orig-postcss-selector-parser.tar.gz
 bd96f1363de935bb849bae64d5a8b5dc851118786d8fae04a6a70344ccdc55e9 12946847 node-css-loader_6.8.1+~cs14.1.4.orig.tar.gz
 af96ce0330fbee96421bed095028405a32e74276c757f69991fcbc8435e21080 5328 node-css-loader_6.8.1+~cs14.1.4-1.debian.tar.xz
Files:
 47ada4e5505e530f4b0797dabc58bfdc 3890 javascript optional node-css-loader_6.8.1+~cs14.1.4-1.dsc
 ba5e468621d739de554443bcf1d804a6 1579 javascript optional node-css-loader_6.8.1+~cs14.1.4.orig-indexes-of.tar.gz
 318e2ea8a105eba5ed5b1c3bd80d293a 97013 javascript optional node-css-loader_6.8.1+~cs14.1.4.orig-postcss-modules-local-by-default.tar.gz
 88cdd009c64ac226cd9997b9919aca18 82836 javascript optional node-css-loader_6.8.1+~cs14.1.4.orig-postcss-modules-scope.tar.gz
 ef60d5a7d7b1159a45e4b8f321f7b133 70080 javascript optional node-css-loader_6.8.1+~cs14.1.4.orig-postcss-selector-parser.tar.gz
 58f32d62d9e6a11dd6c0fa24173c2524 12946847 javascript optional node-css-loader_6.8.1+~cs14.1.4.orig.tar.gz
 5e38705b004faa2472861c9307381d0f 5328 javascript optional node-css-loader_6.8.1+~cs14.1.4-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmo7lCUACgkQ9tdMp8mZ
7umSxg/9EasNV9rTEogUx35LHGFZ4UDSx559ZwxgYqH8V0Uo3VBJ6UOafcENCCr9
YmlsgENnue9AIBMe9ztkfpYEg1P+rtYJAS+X7NaoJ4eJCgAWW+VHCiQfoAYe7dCJ
Mg9HKgEfpaDB9zpCCRhX35+c6hFTWW4FCSw9/zv6rrCN4GaGcWGEGvTkUW1Z2+Sm
fx4HzbFg1vQnqc78BssBRdaWnLvR0fqWoCtWCWBGT4BkOs98lJwBvS5GiN1SyD5/
x2sNBxSeJwv0lGQIvIo7tHwTTJdpSSAV8NIGprnNU4Ciu6aDHNhmzl7A69Pv8IrJ
uJwzyDhOsPRRoE4wOro1dcw+gLaJGtLQ0VCki+BpzJlOKRZ5Bh/H5ArRB8QfTkr+
GDIZ5b2lSTnw5CgJVAdsO7PDQ9iJ0++WdbUea/Jm7lItmDL9FWrysD/MKejN030r
amfVkNBqIoLm0faWZxucuu3JTalrx7rpNtPayaEp0+LzxRAmQPoxyZDN2u0s7In6
sXMi+dWKA9U6xi9SLlEYqQmpxdHpUdnWtERTqCUVeWH6IR2z4DAfC2M2MuCVNXsq
OTjtX13pmVvAwOZYfudT9KDdKAtEA9igKK8ZweOlvD52Sn49Eh5VIZ+OYVmE3VLW
/x9Gnq41f+GlmF8MCOuJMH2IW2Usq+k1Ze8PB2iHrFyh0V1FMmU=
=u8a9
-----END PGP SIGNATURE-----