CVE-2026-9358

What it actually does

postcss-selector-parser versions through 6.1.2 and 7.1.2 contain uncontrolled recursion in the AST Serialization path: the toString implementation on selector containers (src/selectors/container.js) can recurse without a bound when serializing certain selector trees. A successful trigger consumes stack and CPU in the Node.js (or other JS) process performing parse/serialize, resulting in hang, crash (for example Maximum call stack size exceeded), or stalled CSS compilation. Confidentiality and integrity are not affected; availability of the processing worker is. The issue is reachable remotely wherever untrusted or user-supplied CSS selectors are parsed and then stringified.

Why it matters to the business

Build pipelines, SSR, design-system tooling, and any service that compiles or rewrites CSS with PostCSS can be disrupted, delaying releases or taking down request workers that handle stylesheets. Typical PostCSS users who only compile first-party CSS have limited exposure, which matches the vendor’s low-risk stance for server-side DoS on user-generated CSS. CVSS is 4.3 (availability-only, user interaction), the CVE is not in KEV and is not associated with ransomware, and exploit maturity is None. Residual risk is higher for products that accept third-party or user-generated CSS. EPSS remains low (0.0058) but rose about 78% over 30 days (0.0032 → 0.0058), and a public disclosure plus 128 days since publication mean scanners and copycat PoCs may appear. The 6.x line was the most downloaded, so unpatched lockfiles are common in the npm ecosystem.

How an attack unfolds

An attacker who can cause a target application to parse and then serialize CSS selectors they control—for example by submitting a stylesheet, theme, email template, or other user-generated CSS that is run through PostCSS—relies on the vulnerable toString path. After the selector AST is built, serialization walks container nodes recursively; a crafted structure drives unbounded recursion instead of a bounded walk. The worker thread or process spikes CPU, exhausts the call stack, and stops handling further work (DoS). No authentication is required if the CSS intake is public; CVSS models user interaction because a victim workflow (upload, preview, or build of attacker-controlled CSS) typically must run. The issue has been publicly described, but there is no KEV listing, no named APT or ransomware use, and exploit maturity is None, so mass in-the-wild exploitation is not indicated. Operators that never stringify untrusted selectors remain largely out of scope.

How to fix it

Upgrade postcss-selector-parser to 6.1.3 on the 6.x line or 7.1.3 on the 7.x line (patch 5bc698cef66f8abd12610dc623e5d67cbc0f869d; 6.x received the backport because it is the most downloaded line). Refresh lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) so transitive copies are not left on 6.1.2, 7.1.2, or earlier. Prefer overriding nested dependencies if a parent package has not bumped yet. Until upgraded, avoid parsing or serializing untrusted or user-generated CSS in production workers; compile only first-party styles, isolate CSS jobs with timeouts and memory/CPU limits, and fail closed on oversized or deeply nested selector input. Rebuild and redeploy images and serverless bundles that vendor node_modules.

How to confirm the fix worked

Inventory npm/yarn/pnpm trees for postcss-selector-parser below 6.1.3 (6.x) or 7.1.3 (7.x), including transitive and bundled copies in lockfiles, Docker layers, and lambda/zip artifacts. After upgrade, confirm resolved versions with the package manager and that runtime bundles no longer contain the pre-patch container.js toString. Exercise existing CSS compile/preview paths with normal first-party stylesheets and confirm workers complete without stack overflow. Where user CSS is supported, keep processing in a timeout-bounded worker and verify oversized or pathological selector input is rejected or isolated rather than processed in the main request loop. Re-scan SCA results until the CVE is cleared.

Typical attack path

1. Identify a reachable workflow that accepts CSS or selectors from untrusted input and processes them with PostCSS / postcss-selector-parser (upload, theme import, SSR, email/CSS inlining, or a CI job on a public repo).
2. Supply a stylesheet or selector that the parser turns into an AST whose container serialization recurses without bound in toString.
3. Trigger parse plus serialization (preview, compile, lint, or save), causing stack/CPU exhaustion in the Node.js or build worker.
4. Repeat or automate submissions to keep workers crashed or hung, denying CSS compilation or related request handling.
5. Optionally chain with other load against the same pool so recovery (process restart) does not restore service.

How to detect it

This CVE causes process-level denial of service, not persistence or data theft, so look for availability artifacts rather than malware. Review Node.js/application logs and APM around CSS compile, PostCSS, and stylesheet preview/upload endpoints for RangeError/stack overflow originating in postcss-selector-parser or selectors/container.js, worker timeouts, and crash-loop restarts coinciding with CSS submissions. Correlate with HTTP or queue intake of stylesheets (uploads, theme APIs, CI jobs on untrusted branches) and with CPU saturation of build or SSR processes. There are no named threat actors or KEV/ransomware campaigns; treat isolated crashes during CSS serialization as more likely than a targeted intrusion. Historical window starts at publication (2026-05-24). Packet captures will not show a unique C2 pattern—focus on application errors and process metrics.

• RangeError: Maximum call stack size exceeded
• postcss-selector-parser
• src/selectors/container.js
• selectors/container.js
• toString
• PostCSS
• uncaughtException
• FATAL ERROR: Ineffective mark-compacts near heap limit
• JavaScript heap out of memory
• npm:postcss-selector-parser

What your security team should do

• Patch postcss-selector-parser to 6.1.3 or 7.1.3 everywhere, including transitive 6.x (highest download volume) and frozen CI images.
• SCA-grep lockfiles and deployed node_modules for <=6.1.2 and <=7.1.2; fail builds that still resolve those versions.
• Treat user-generated CSS compile/serialize as untrusted: timeouts, process isolation, and size/depth limits even after patching.
• Prioritize internet-facing or multi-tenant CSS intake over internal first-party PostCSS builds, consistent with the vendor’s lower-risk model for self-compiled CSS.
• Watch EPSS and public PoC chatter; this is not KEV and not ransomware-linked, but public disclosure and a rising EPSS warrant tracking rather than deferral past the next patch window.
• Add crash/restart alerts on CSS build and SSR workers (stack overflow, unbounded CPU) as a compensating control.