CVE-2026-9358: PostCSS postcss-selector-parser uncontrolled recursion in AST serialization

Executive brief

postcss-selector-parser is a JavaScript library used to parse and manipulate CSS selectors. A flaw in its AST serialization logic can cause the library to enter infinite recursion when processing specially crafted input, consuming CPU and memory until the process crashes. While this can disrupt services that accept user-generated CSS, the vendor notes most users compile their own CSS, limiting exposure in typical deployments.

Technical details

The vulnerability exists in the toString method of src/selectors/container.js component, where uncontrolled recursive calls can be triggered through AST manipulation. An attacker can provide malformed CSS selectors that create deeply nested or circular AST structures, causing the serialization process to recurse indefinitely. The attack is remotely exploitable with no authentication or privileges required, but requires user interaction (processing of attacker-controlled CSS). The attack vector is network-based with low complexity. Patches are available in versions 6.1.3 and 7.1.3.

Affected products

• postcss postcss-selector-parser 6.1.0 to 6.1.2, 7.1.0 to 7.1.2

Timeline

• 2026-05-26: disclosed: Publicly disclosed
• 2026-05-26: patched: Versions 6.1.3 and 7.1.3 released with fixes

References

• https://api.github.com/users/MoOx
• https://github.com/MoOx
• https://api.github.com/users/MoOx/gists%7B/gist_id%7D
• https://api.github.com/users/MoOx/repos
• https://avatars.githubusercontent.com/u/157534?v=4
• https://api.github.com/users/MoOx/events%7B/privacy%7D