CVE-2026-9358

Name	CVE-2026-9358
Description	A vulnerability was determined in postcss up to 7.1.1. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains, that according to his definition "DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS)."
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1139161

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-css-loader (PTS)	bullseye	5.0.1+~cs14.0.5-1	vulnerable
	bookworm	6.7.2+~cs14.0.11-1	vulnerable
	trixie	6.8.1+~cs14.0.17-1	vulnerable
	forky, sid	6.8.1+~cs14.0.17-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-css-loader	source	(unstable)	(unfixed)			1139161

Notes

[trixie] - node-css-loader <no-dsa> (Minor issue)
[bookworm] - node-css-loader <no-dsa> (Minor issue)
https://gist.github.com/bx33661/581e3a38134601c04e19b4dfc9b459b9
postcss-selector-parser embedded in node-css-loader