CVE-2026-9358

MediumCVSS 4.3

Published: 24/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

Vulnerability in postcss-selector-parser up to 6.1.2/7.1.2 affects the toString function in src/selectors/container.js (AST Serialization component). Manipulation can lead to uncontrolled recursion. Remote attack is possible. Fixed in versions 6.1.3 and 7.1.3.

Risk Assessment

An attacker can cause a denial of service (DoS) on the server by sending specially crafted CSS, potentially overloading the server and disrupting application availability.

Recommendation

Upgrade postcss-selector-parser to version 6.1.3 or 7.1.3, which fix the uncontrolled recursion issue.

Other vulnerabilities in postcss-selector-parser

CVE-2026-104844Medium
PostCSS Selector Parser before version 7.1.6 has a performance issue — parsing a malicious CSS selector can be quadratic, allowing a parser thread to be blocked. Only consumers that synchronously parse untrusted selectors in an exposed request path are affected.

Original NVD description (English source)

A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 6.1.3 and 7.1.3 is able to address this issue. This patch is called 5bc698cef66f8abd12610dc623e5d67cbc0f869d. It is suggested to upgrade the affected component. The vendor explains, that according to his definition "DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS)." The commits were backported to 6.x branch, which was the most downloaded version.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS