Home

Description

A vulnerability was determined in postcss up to 7.1.1. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains, that according to his definition "DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS)."

PUBLISHED Reserved 2026-05-23 | Published 2026-05-24 | Updated 2026-05-29 | Assigner VulDB




MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
MEDIUM: 4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C
MEDIUM: 4.3CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C
5.0AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:C

Problem types

Uncontrolled Recursion

Denial of Service

Timeline

2026-05-23:Advisory disclosed
2026-05-23:VulDB entry created
2026-05-23:VulDB entry last update

Credits

bx33661 (VulDB User) reporter

VulDB CNA Team coordinator

References

vuldb.com/vuln/365321 (VDB-365321 | postcss AST Serialization container.js toString recursion) vdb-entry technical-description

vuldb.com/vuln/365321/cti (VDB-365321 | CTI Indicators (IOB, IOC, TTP, IOA)) signature permissions-required

vuldb.com/submit/813080 (Submit #813080 | postcss-selector-parser postcss <= 7.1.1 CWE-674: Uncontrolled Recursion) third-party-advisory

gist.github.com/bx33661/581e3a38134601c04e19b4dfc9b459b9 exploit

cve.org (CVE-2026-9358)

nvd.nist.gov (CVE-2026-9358)

Download JSON