What’s Vulnerable › Vulnerabilities

CVE-2026-93752: CSSOM through 0.5.0 Denial of Service via length Property

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-18 · updated 2026-09-22
• Weakness: CWE-915

Description

CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() that fails to validate reserved property names. Attackers can supply a stylesheet with a declaration named length to replace the internal counter and trigger excessive memory allocation during cssText serialization, causing process termination.

Affected products

• NV CSSOM: through 0.5.0

References

• https://github.com/NV/CSSOM
• https://github.com/NV/CSSOM/blob/00ec21868e12422581c81779135c2f1648441204/lib/CSSStyleDeclaration.js#L112-L124
• https://github.com/NV/CSSOM/blob/00ec21868e12422581c81779135c2f1648441204/lib/CSSStyleDeclaration.js#L41-L56
• https://github.com/NV/CSSOM/issues/119
• https://www.vulncheck.com/advisories/cssom-through-0.5.0-denial-of-service-via-length-property
• https://github.com/NV/CSSOM/issues/119

Get alerted when CVE-2026-93752 or the next vulnerability affects your stack