The vulnerability CVE-2026-9358 affects the postcss library up to version 7.1.1. It arises from uncontrolled recursion in the toString function within the AST Serialization component (src/selectors/container.js). An attacker can remotely exploit this by crafting malicious CSS input that triggers infinite recursion, leading to a denial of service condition. The CVSS 4.0 base score is 5.3, reflecting a medium severity with network attack vector, no privileges required, and no user interaction needed. The vendor has publicly disclosed the issue but classifies the risk as low due to typical usage patterns where users compile their own CSS. There is no vendor advisory or patch available at this time.

Successful exploitation can cause a denial of service on the server processing user-generated CSS by triggering uncontrolled recursion. This may lead to application unavailability or resource exhaustion. There is no indication of code execution, data breach, or privilege escalation. The vulnerability is exploitable remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting or sanitizing user-generated CSS inputs processed by postcss to reduce exposure. The vendor currently rates the risk as low due to typical usage scenarios. Monitor vendor communications for updates.