Denial-of-Service Vulnerability in JustHTML by Emil Stenström

CVE-2026-4671

What is CVE-2026-4671?

JustHTML, prior to version 1.18.0, contains several low-severity denial-of-service issues related to CSS selector handling and linkification. Applications that process attacker-controlled selector strings—using functions such as query() or matches()—face potential risks when handling large and untrusted documents. This vulnerability can lead to excessive CPU or memory usage under certain conditions, such as oversized selectors, large selector lists, or complex combinator chains. While it does not permit script execution or data leakage, the impact on availability should not be overlooked, particularly in highly dynamic or untrusted environments.

References