CVE-2026-9358

MEDIUM

postcss AST Serialization container.js toString recursion

Title source: cna
STIX 2.1

Description

A vulnerability was determined in postcss up to 7.1.1. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains, that according to his definition "DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS)."

References (4)

Core 4
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-365321 | postcss AST Serialization container.js toString recursion
https://vuldb.com/vuln/365321
Signature, Permissions Required signature permissions-required
VDB-365321 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/365321/cti
Third Party Advisory third-party-advisory
Submit #813080 | postcss-selector-parser postcss <= 7.1.1 CWE-674: Uncontrolled Recursion
https://vuldb.com/submit/813080

Scores

CVSS v3 4.3
EPSS 0.0004
EPSS Percentile 11.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-404 CWE-674
Status published
Products (2)
None/postcss 7.1.0
None/postcss 7.1.1
Published May 24, 2026
Tracked Since May 24, 2026