CVE-2026-9358: postcss-selector-parser Denial of Service via Uncontrolled AST Recursion
Summary
CVE-2026-9358: postcss-selector-parser allows denial of service through uncontrolled AST recursion. Affects postcss-selector-parser across 2 version ranges.
>= 6.1.0, < 6.1.3
>= 7.1.0, < 7.1.3
Fixed in 6.1.3 or 7.1.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
postcss-selector-parser is a widely used npm package that facilitates the parsing and manipulation of CSS selectors. It is integral to many CSS processing workflows, allowing developers to work with selectors in a structured manner. However, prior versions of this package are susceptible to a vulnerability that can lead to denial of service (DoS) attacks, particularly when handling user-generated CSS.
Vulnerability Detail
The vulnerability identified as CVE-2026-9358 exists in the toString function of the src/selectors/container.js file within postcss-selector-parser versions prior to 6.1.3 and 7.1.3. This flaw allows for uncontrolled recursion when processing certain inputs, which can be exploited to cause a denial of service. An attacker can remotely trigger this vulnerability by sending specially crafted CSS selectors, leading to potential server crashes or resource exhaustion.
How To Fix
Latest published version: 7.1.7 as of 23 Oct 2026
npm install postcss-selector-parser@7.1.7Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.1.0, < 6.1.36.1.3npm install postcss-selector-parser@6.1.3 -
>= 7.1.0, < 7.1.37.1.3npm install postcss-selector-parser@7.1.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can implement input validation to sanitize CSS selectors before they are processed by postcss-selector-parser. This can help prevent malicious inputs from triggering the vulnerability. For example:
function sanitizeCSSSelector(selector) {
// Implement validation logic here
return selector;
}
const safeSelector = sanitizeCSSSelector(userInput);
const parsedSelector = postcssSelectorParser.parse(safeSelector);
Conclusion
CVE-2026-9358 poses a significant risk to applications using vulnerable versions of postcss-selector-parser, allowing for denial of service through uncontrolled recursion. It is crucial to update to the latest patched versions to mitigate this risk and ensure the stability of your application.
See every vulnerability recorded for postcss-selector-parser →
FAQ
CVE-2026-9358 is a vulnerability in postcss-selector-parser that allows for denial of service through uncontrolled recursion in the AST serialization process.
Versions of postcss-selector-parser prior to 6.1.3 and 7.1.3 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing your package-lock.json file. You can also check your application using the Vulert playground without any signup.
Exploiting this vulnerability can lead to denial of service, causing your application to crash or become unresponsive when processing malicious CSS selectors.
If immediate updates are not possible, implement input validation to sanitize CSS selectors before processing them with postcss-selector-parser.
References
Related vulnerabilities
Recent vulnerabilities recorded for postcss-selector-parser.
