CVE-2026-93752: CSSOM through 0.5.0 Denial of Service via length Property

Q: What input must an attacker control to trigger the denial of service?

The attacker must be able to supply a stylesheet containing a declaration named length. The issue is triggered when CSSStyleDeclaration.setProperty() accepts that reserved property name and cssText is subsequently serialized.

Q: What is the practical impact of successful exploitation?

The length declaration can replace an internal counter, causing excessive memory allocation during cssText serialization. This can terminate the affected process.

Q: Which versions are identified as affected?

CSSOM through version 0.5.0 is identified as affected.

Published Sep 18, 2026

Updated

CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() that fails to validate reserved property names. Attackers can supply a stylesheet with a declaration named length to replace the internal counter and trigger excessive memory allocation during cssText serialization, causing process termination.

Affected Software

1 affected component

CSSOM<=0.5.0

Event History

Sep 18, 2026

CVE Published

via MITRE·05:51 PM

Data Sourced

via MITRE·05:51 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What input must an attacker control to trigger the denial of service?

The attacker must be able to supply a stylesheet containing a declaration named length. The issue is triggered when CSSStyleDeclaration.setProperty() accepts that reserved property name and cssText is subsequently serialized.

What is the practical impact of successful exploitation?

The length declaration can replace an internal counter, causing excessive memory allocation during cssText serialization. This can terminate the affected process.

Which versions are identified as affected?