NV CSSOM versions up to 0.5.0 contain a denial of service vulnerability in the CSSStyleDeclaration.setProperty() method. The vulnerability is due to failure to validate reserved property names, specifically allowing an attacker to supply a stylesheet with a declaration named 'length'. This replaces an internal counter and triggers excessive memory allocation during cssText serialization, causing the process to terminate unexpectedly.

Successful exploitation results in denial of service by causing process termination through excessive memory allocation. There is no indication of privilege escalation, data disclosure, or code execution. The vulnerability can be triggered remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor communications for updates and consider restricting untrusted stylesheet inputs as a temporary mitigation.