Executive brief
CSSOM is a JavaScript CSS parser and object model implementation used in web browsers and Node.js environments. A vulnerability in the setProperty() method fails to validate reserved property names, allowing attackers to supply a malicious stylesheet that replaces an internal counter and causes excessive memory allocation during serialization, leading to application crash or denial of service.
Technical details
The vulnerability exists in CSSStyleDeclaration.setProperty() which does not validate reserved property names like "length". An attacker can inject a stylesheet with a declaration named "length" to overwrite the internal length counter, triggering uncontrolled memory allocation during cssText serialization. This results in process termination or out-of-memory conditions without requiring authentication or user interaction beyond stylesheet processing.
Affected products
- NV CSSOM through 0.5.0
Timeline
- 2026-09-18: disclosed