Denial of Service Vulnerability in CSSOM by NV
CVE-2026-93752

8.7HIGH

Key Information:

Vendor

Nv

Status
Cssom
Vendor
CVE Published:
18 September 2026

What is CVE-2026-93752?

The CSSOM library, up to version 0.5.0, is susceptible to a denial of service attack due to improper validation of reserved property names in the CSSStyleDeclaration.setProperty() function. Malicious actors can exploit this flaw by submitting a stylesheet containing a property declaration named 'length'. This unauthorized declaration can replace an internal counter, leading to excessive memory allocation during the cssText serialization process. Consequently, this may cause the running process to terminate unexpectedly, disrupting service and impacting users.

Affected Version(s)

CSSOM 0 <= 0.5.0

References

https://github.com/NV/CSSOM/issues/119
issue-tracking
https://github.com/NV/CSSOM
product
https://github.com/NV/CSSOM/blob/00ec21868e12422581c81779...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wayde Shi (PayPal Cyber Security Team)
.