CVE-2026-9358: PostCSS Denial of Service Vulnerability

CVE-2026-9358 Overview

CVE-2026-9358 affects postcss versions up to 7.1.1. The vulnerability resides in the toString function of src/selectors/container.js, part of the AST Serialization component. A crafted input triggers uncontrolled recursion [CWE-404], leading to a denial-of-service condition when the affected code processes user-supplied CSS.

The issue is exploitable remotely, requires user interaction, and a public proof-of-concept is available. The vendor characterizes server-side DoS on user-generated CSS as low risk, since most users compile their own CSS with PostCSS rather than processing untrusted input.

Critical Impact
Remote attackers can trigger uncontrolled recursion in the postcss toString AST serializer, causing process resource exhaustion and denial of service in applications that parse untrusted CSS.

Affected Products

postcss versions up to and including 7.1.1
Applications embedding the src/selectors/container.js AST Serialization component
Server-side build pipelines processing untrusted user-generated CSS

Discovery Timeline

2026-05-24 - CVE-2026-9358 published to the National Vulnerability Database (NVD)
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9358

Vulnerability Analysis

The defect resides in the toString method of the selector container in src/selectors/container.js. When the AST serializer walks a selector tree, it recursively invokes toString on child nodes. The code does not bound recursion depth or detect cyclic structures during serialization.

An attacker crafts a deeply nested or self-referential selector structure that the parser accepts. When downstream code calls toString on that AST, the call stack grows until the JavaScript runtime throws a stack overflow. The Node.js worker handling the request terminates or stalls, depending on how the consuming application handles the exception.

The weakness is categorized as Improper Resource Shutdown or Release [CWE-404]. The impact is limited to availability — confidentiality and integrity remain intact. Single-process Node.js services that synchronously serialize untrusted CSS are most exposed.

Root Cause

The root cause is missing recursion-depth validation in the AST serialization path. The toString implementation assumes well-formed, finite selector trees and lacks guards against pathological nesting or cycles introduced through manipulated input.

Attack Vector

Exploitation requires the attacker to submit CSS or a selector structure that the target application passes to postcss for parsing and subsequent serialization. The attack is remote, has low complexity, and requires user interaction in the vector. A public PoC is referenced via GitHub Gist PoC Resource and VulDB Vulnerability #365321.

The vulnerability manifests when the manipulated AST is converted back to a string. See the linked references for technical reproduction details.

Detection Methods for CVE-2026-9358

Indicators of Compromise

Node.js processes terminating with RangeError: Maximum call stack size exceeded originating from postcss frames
Repeated requests to CSS-processing endpoints followed by worker restarts or 5xx responses
Abnormally large or deeply nested CSS payloads submitted to build or rendering services

Detection Strategies

Inventory dependencies and identify projects pinning postcss at or below version 7.1.1 via npm ls postcss or package-lock.json audits
Inspect application logs for stack overflow exceptions tied to container.js and the toString method
Instrument CSS-processing endpoints with request-size and parse-time thresholds to flag anomalous inputs

Monitoring Recommendations

Track CPU and memory utilization on Node.js workers that parse user-supplied CSS
Alert on recurring crashes or restarts of services using postcss in the call chain
Forward web application firewall logs and Node.js crash dumps to a centralized analytics platform for correlation

How to Mitigate CVE-2026-9358

Immediate Actions Required

Audit all direct and transitive dependencies on postcss and identify versions at or below 7.1.1
Restrict server-side processing of untrusted CSS to isolated worker processes with strict timeouts
Apply input-size limits and reject CSS payloads exceeding defined depth or length thresholds at the application edge

Patch Information

No vendor-supplied patch is referenced in the published advisory. The vendor classifies server-side DoS on user-generated CSS as low risk. Monitor the postcss repository and VulDB Vulnerability #365321 for any subsequent fix releases, and upgrade to a fixed version when available.

Workarounds

Move CSS parsing to short-lived child processes or worker threads so a stack overflow does not crash the main service
Validate and sanitize incoming CSS before invoking toString, rejecting deeply nested selector structures
Cap request body sizes for endpoints that accept CSS to reduce the feasible attack surface
Where feasible, perform CSS compilation at build time rather than processing user-generated CSS at runtime

bash

# Configuration example
# Identify vulnerable postcss installations
npm ls postcss

# Override a transitive dependency to a non-vulnerable release once available
# package.json
#   "overrides": {
#     "postcss": ">=8.0.0"
#   }
npm install
npm audit