CVE-2026-9358

A flaw was found in postcss. A remote attacker could exploit a vulnerability in the toString function of the AST Serialization component by executing a manipulation, leading to uncontrolled recursion. This uncontrolled recursion can result in a Denial of Service (DoS) condition, making the affected system unavailable.

Moderate: This flaw in Postcss can lead to a denial of service (DoS) in applications that process untrusted CSS. The vulnerability arises from uncontrolled recursion in the AST Serialization component when handling specially crafted CSS. Exploitation requires user interaction, such as submitting attacker-controlled CSS, which reduces the risk in environments where CSS is typically pre-compiled or not directly user-modifiable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to PostCSS 8.5.6 or later. As a workaround, validate and sanitize CSS input before processing with PostCSS to prevent deeply nested or malicious structures from reaching the serializer.