fix(webpack): bump postcss-loader to ^8.2.1 to eliminate transitive yaml@1.x CVE by robert-sidzinka · Pull Request #35028 · nrwl/nx

robert-sidzinka · 2026-03-26T20:24:07Z

Current Behavior

@nx/webpack depends on postcss-loader@^6.1.1, which pulls in cosmiconfig@7 → [email protected]. The [email protected] package has a known stack overflow vulnerability (GHSA-48c2-rrv3-qjmp).

Expected Behavior

By bumping postcss-loader to ^8.2.1, the transitive dependency chain is eliminated entirely — postcss-loader@8 uses cosmiconfig@9, which no longer depends on yaml at all. This is a cleaner fix than applying a pnpm.overrides workaround.

The upgrade is safe because:

postcss-loader@8 peer deps (postcss ^7||^8, webpack ^5) are unchanged
The implementation option and function-based postcssOptions API used by @nx/webpack are fully supported in v8
Nx already requires Node 18+, matching postcss-loader@8's engine requirement

Related Issue(s)

Fixes #35025

netlify · 2026-03-26T20:24:11Z

✅ Deploy Preview for nx-docs canceled.

Name	Link
🔨 Latest commit	1e53741f2a68be37dca083bdd13f36b9fd855a44
🔍 Latest deploy log	https://app.netlify.com/projects/nx-docs/deploys/69c595eb2d1771000836dae0

netlify · 2026-03-26T20:24:11Z

✅ Deploy Preview for nx-dev canceled.

Name	Link
🔨 Latest commit	7e8b0fc10cb7955f81185ed7f63cec5a0646301a
🔍 Latest deploy log	https://app.netlify.com/projects/nx-dev/deploys/69c70a9ff175370008e15d15

graphite-app · 2026-03-26T20:27:26Z

@@ -408,6 +408,11 @@
    "tslib": "catalog:typescript",
    "webpack-cli": "^5.1.4"
  },
+  "pnpm": {
+    "overrides": {
+      "yaml@^1.10.0": ">=1.10.3"


The override pattern "yaml@^1.10.0": ">=1.10.3" is too permissive and will match yaml 2.x versions, which have breaking changes from yaml 1.x. This causes packages expecting yaml 1.x API (like cosmiconfig) to receive yaml 2.8.2 (visible in pnpm-lock.yaml), which will break at runtime due to API incompatibilities.

Fix by constraining to 1.x:

"yaml@^1.10.0": ">=1.10.3 <2.0.0"

Suggested change

"yaml@^1.10.0": ">=1.10.3"

"yaml@^1.10.0": ">=1.10.3 <2.0.0"

Spotted by Graphite

Is this helpful? React 👍 or 👎 to let us know.

FrozenPandaz · 2026-03-27T21:19:26Z

Thanks for flagging this! However, there are a couple of issues with this approach:

`pnpm.overrides` don't help end users

pnpm.overrides only take effect at the root of the project that declares them. They don't propagate to consumers who install @nx/js, @nx/webpack, etc. So this override would only fix the vulnerability in the Nx repo's own development environment — anyone installing Nx packages in their project would still pull in [email protected] through the same transitive chain (babel-plugin-macros → cosmiconfig@7 → [email protected]).

For users who are seeing this flagged in their own audits, they'd need to add the override in their own package.json themselves.

There are two transitive paths that pull in [email protected]:

`babel-plugin-macros`

@nx/js → babel-plugin-macros → cosmiconfig@7 → [email protected]. The package hasn't been updated in 5+ years and still pins cosmiconfig@^7. With no upstream fix likely, we may consider dropping babel-plugin-macros from our Babel preset — though that's a separate discussion.

`postcss-loader`

@nx/webpack → postcss-loader@^6.1.1 → cosmiconfig@7 → [email protected]. This one we can fix. Bumping postcss-loader to ^8.2.1 would eliminate this path entirely — postcss-loader 8 uses cosmiconfig@9 which doesn't depend on yaml at all. The peer deps are unchanged (postcss ^7||^8, webpack ^5) and Nx already requires Node 18+, so it should be a safe bump. Would you be interested in updating this PR to take that approach instead?

FrozenPandaz

See comment above

robert-sidzinka · 2026-03-27T22:56:53Z

@FrozenPandaz thanks, I updated PR by upgrading postcss-loader package.
It's indeed a safe bump as no code changes are required.

…[email protected] CVE postcss-loader 8 uses cosmiconfig@9 which no longer depends on [email protected], removing the vulnerable transitive dependency path entirely.

nx-cloud · 2026-03-27T23:13:39Z

View your CI Pipeline Execution ↗ for commit 2805cb6

Command	Status	Duration	Result
`nx affected --targets=lint,test,build,e2e,e2e-c...`	✅ Succeeded	10m 23s	View ↗
`nx run-many -t check-imports check-lock-files c...`	✅ Succeeded	7s	View ↗
`nx-cloud record -- pnpm nx conformance:check`	✅ Succeeded	7s	View ↗
`nx build workspace-plugin`	✅ Succeeded	1m 17s	View ↗
`nx-cloud record -- nx format:check`	✅ Succeeded	1s	View ↗
`nx-cloud record -- nx sync:check`	✅ Succeeded	<1s	View ↗

☁️ Nx Cloud last updated this comment at 2026-03-28 05:37:25 UTC

nx-cloud

Nx Cloud has identified a flaky task in your failed CI:

Since the failure was identified as flaky, the solution is to rerun CI. Because this branch comes from a fork, it is not possible for us to push directly, but you can rerun by pushing an empty commit:

git commit --allow-empty -m "chore: trigger rerun"
git push

View detailed reasoning in Nx Cloud ↗

🔔 Heads up, your workspace has pending recommendations ↗ to auto-apply fixes for similar failures.

_{🎓 Learn more about Self-Healing CI on nx.dev}

FrozenPandaz

Everything looks good! Thank you so much for your contribution!

…[email protected] CVE (#35028) ## Current Behavior `@nx/webpack` depends on `postcss-loader@^6.1.1`, which pulls in `cosmiconfig@7` → `[email protected]`. The `[email protected]` package has a known stack overflow vulnerability ([GHSA-48c2-rrv3-qjmp](GHSA-48c2-rrv3-qjmp)). ## Expected Behavior By bumping `postcss-loader` to `^8.2.1`, the transitive dependency chain is eliminated entirely — `postcss-loader@8` uses `cosmiconfig@9`, which no longer depends on `yaml` at all. This is a cleaner fix than applying a `pnpm.overrides` workaround. The upgrade is safe because: - `postcss-loader@8` peer deps (`postcss ^7||^8`, `webpack ^5`) are unchanged - The `implementation` option and function-based `postcssOptions` API used by `@nx/webpack` are fully supported in v8 - Nx already requires Node 18+, matching postcss-loader@8's engine requirement ## Related Issue(s) Fixes #35025 (cherry picked from commit 63a8f27)

github-actions · 2026-04-06T00:20:19Z

This pull request has already been merged/closed. If you experience issues related to these changes, please open a new issue referencing this pull request.

robert-sidzinka requested a review from a team as a code owner March 26, 2026 20:24

robert-sidzinka requested a review from FrozenPandaz March 26, 2026 20:24

graphite-app Bot reviewed Mar 26, 2026

View reviewed changes

FrozenPandaz requested changes Mar 27, 2026

View reviewed changes

robert-sidzinka force-pushed the fix/yaml-vulnerability branch from 1e53741 to 7e8b0fc Compare March 27, 2026 22:54

robert-sidzinka changed the title ~~fix: override [email protected] to >=1.10.3 to resolve CVE vulnerability~~ fix(webpack): bump postcss-loader to ^8.2.1 to eliminate transitive [email protected] CVE Mar 27, 2026

fix(webpack): bump postcss-loader to ^8.2.1 to eliminate transitive y…

2805cb6

…[email protected] CVE postcss-loader 8 uses cosmiconfig@9 which no longer depends on [email protected], removing the vulnerable transitive dependency path entirely.

robert-sidzinka force-pushed the fix/yaml-vulnerability branch from 7e8b0fc to 2805cb6 Compare March 27, 2026 22:57

nx-cloud Bot reviewed Mar 28, 2026

View reviewed changes

FrozenPandaz approved these changes Mar 31, 2026

View reviewed changes

FrozenPandaz merged commit 63a8f27 into nrwl:master Mar 31, 2026
24 of 26 checks passed

github-actions Bot locked as resolved and limited conversation to collaborators Apr 6, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(webpack): bump postcss-loader to ^8.2.1 to eliminate transitive [email protected] CVE#35028

fix(webpack): bump postcss-loader to ^8.2.1 to eliminate transitive [email protected] CVE#35028
FrozenPandaz merged 1 commit into
nrwl:masterfrom
robert-sidzinka:fix/yaml-vulnerability

robert-sidzinka commented Mar 26, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Mar 26, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Mar 26, 2026 •

edited

Loading

Uh oh!

graphite-app Bot Mar 26, 2026

Uh oh!

FrozenPandaz commented Mar 27, 2026

Uh oh!

FrozenPandaz left a comment

Uh oh!

robert-sidzinka commented Mar 27, 2026

Uh oh!

nx-cloud Bot commented Mar 27, 2026 •

edited

Loading

Uh oh!

nx-cloud Bot left a comment

Uh oh!

FrozenPandaz left a comment

Uh oh!

Uh oh!

github-actions Bot commented Apr 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

robert-sidzinka commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Current Behavior

Expected Behavior

Related Issue(s)

Uh oh!

netlify Bot commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for nx-docs canceled.

Uh oh!

netlify Bot commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for nx-dev canceled.

Uh oh!

graphite-app Bot Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

FrozenPandaz commented Mar 27, 2026

pnpm.overrides don't help end users

babel-plugin-macros

postcss-loader

Uh oh!

FrozenPandaz left a comment

Choose a reason for hiding this comment

Uh oh!

robert-sidzinka commented Mar 27, 2026

Uh oh!

nx-cloud Bot commented Mar 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nx-cloud Bot left a comment

Choose a reason for hiding this comment

Nx Cloud has identified a flaky task in your failed CI:

Uh oh!

FrozenPandaz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Apr 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

robert-sidzinka commented Mar 26, 2026 •

edited

Loading

netlify Bot commented Mar 26, 2026 •

edited

Loading

netlify Bot commented Mar 26, 2026 •

edited

Loading

`pnpm.overrides` don't help end users

`babel-plugin-macros`

`postcss-loader`

nx-cloud Bot commented Mar 27, 2026 •

edited

Loading