CVE-2026-93752: CSSOM Library DOS Vulnerability

CVE-2026-93752 Overview

CVE-2026-93752 is a denial of service vulnerability in the CSSOM library through version 0.5.0. The flaw resides in CSSStyleDeclaration.setProperty(), which fails to validate reserved property names before assignment. Attackers can supply a stylesheet containing a declaration named length to overwrite the internal counter used by the CSSOM implementation. When the affected object is later serialized via cssText, the corrupted counter triggers excessive memory allocation and terminates the host process. Applications parsing untrusted CSS with CSSOM, including server-side rendering pipelines and headless browser tooling, are exposed to remote resource exhaustion.

Critical Impact
A single malicious CSS declaration can crash any Node.js process that parses attacker-controlled stylesheets through CSSOM.

Affected Products

CSSOM library versions through 0.5.0
Node.js applications that parse untrusted CSS through CSSOM
Downstream tooling that depends on CSSOM for stylesheet processing

Discovery Timeline

2026-09-18 - CVE-2026-93752 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93752

Vulnerability Analysis

CSSOM implements CSSStyleDeclaration as a JavaScript object that stores parsed CSS properties alongside an internal length field. The length field tracks how many declarations the object holds and drives iteration during cssText serialization. The setProperty() method writes to the object using the property name supplied by the caller without maintaining a reserved-name deny list. A stylesheet declaration named length therefore replaces the numeric counter with a string. When cssText is subsequently invoked, the serializer treats the corrupted length value as an iteration bound and attempts to allocate memory proportional to that value, exhausting the Node.js heap and terminating the process. The issue is categorized as [CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes].

Root Cause

The root cause is missing input validation in CSSStyleDeclaration.setProperty(). The implementation trusts every property name coming from a parsed stylesheet and writes directly onto the object, allowing attacker-supplied names to collide with internal state such as length.

Attack Vector

Exploitation requires only that a target application parse an attacker-controlled stylesheet and then read or serialize the resulting cssText. No authentication or user interaction is required. Any network-facing service that ingests third-party CSS, such as email renderers, HTML sanitizers, or headless test runners, can be crashed by delivering a single stylesheet containing length: <value>;.

No verified exploit code is published. See the VulnCheck Advisory on CSSOM and GitHub CSSOM Issue #119 for the technical write-up.

Detection Methods for CVE-2026-93752

Indicators of Compromise

Node.js worker processes terminating with FATAL ERROR: Reached heap limit Allocation failed shortly after CSS parsing.
Inbound HTTP payloads or uploaded stylesheets containing a length property declaration inside a CSS rule.
Sudden spikes in resident memory usage in services that call CSSOM.parse() or read .cssText on parsed stylesheets.

Detection Strategies

Inspect application logs for repeated crashes correlated with CSS parsing endpoints and out-of-memory exit codes.
Add a pre-parser filter that flags declarations whose property name matches reserved CSSStyleDeclaration attributes such as length, parentRule, or cssText.
Enumerate dependency trees with npm ls cssom to identify direct and transitive usage of vulnerable versions.

Monitoring Recommendations

Track process restart counts and heap allocation metrics for services performing CSS parsing.
Alert on stylesheet payloads that exceed a size threshold or contain reserved property names before they reach CSSOM.
Correlate crash telemetry with source IPs to identify repeated abuse patterns.

How to Mitigate CVE-2026-93752

Immediate Actions Required

Inventory all applications and container images that bundle CSSOM 0.5.0 or earlier, including transitive dependencies.
Restrict untrusted CSS parsing to isolated worker processes with hard memory limits so a crash does not affect the parent service.
Sanitize inbound stylesheets to reject declarations whose property name equals a reserved internal attribute of CSSStyleDeclaration.

Patch Information

At publication, no fixed release is listed in the enriched data. Track the GitHub CSSOM Repository and GitHub CSSOM Issue #119 for an upstream patch. Consumers should upgrade as soon as a fixed version becomes available or migrate to an actively maintained CSS parser.

Workarounds

Wrap CSSOM.parse() calls in a wrapper that removes or renames any declaration keyed by length before serialization.
Enforce Node.js process memory ceilings using --max-old-space-size and container cgroup limits so exhaustion is contained.
Rate-limit endpoints that accept user-supplied CSS to reduce the impact of automated abuse.

bash

# Configuration example
npm ls cssom
node --max-old-space-size=256 render-worker.js