Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 - #316
Conversation
Sorry, something went wrong.
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds AVA regression coverage to ensure deeply nested selectors no longer cause uncontrolled recursion/stack overflow (CVE-2026-9358 / SNYK-JS-POSTCSSSELECTORPARSER-16873882), and that failures surface as catchable errors.
Changes:
- Adds parse-time regression tests for deeply nested :not(...) selectors exceeding the maximum depth.
- Adds serialization (toString) regression test by building a deep AST that bypasses parsing guards.
- Adds tests for the maxNestingDepth option (tightening and loosening the limit).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Sorry, something went wrong.
| export default function resolveMaxNestingDepth (value) { | ||
| return Number.isSafeInteger(value) && value >= 0 ? value : MAX_NESTING_DEPTH; | ||
| } |
There was a problem hiding this comment.
Won't clamp. maxNestingDepth is trusted developer configuration, never derived from the parsed CSS, so it isn't reachable by an attacker (whose only input is the selector string, already capped by the default of 256). There's also no universally correct ceiling — the safe stack depth is environment-dependent — so a hard clamp would either reject legitimate raised limits or still be unsafe on small stacks. Documented the caveat in the README instead.
Sorry, something went wrong.
Closes #315
The fix basically prevent stack overflow on deeply nested selectors (CVE-2026-9358)
Deeply nested selectors (e.g. :not(:not(:not(…)))) caused uncontrolled recursion in both parsing and toString() serialization, overflowing the call stack with an uncatchable RangeError (CWE-674 / SNYK-JS-POSTCSSSELECTORPARSER-16873882).
Add a nesting-depth limit (default 256, far beyond any real selector) that raises a clear, catchable Error instead of crashing: