Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

Author: MoOx

src/__tests__/recursion.mjs

@@ -47,6 +47,18 @@ ava("serializing a deeply nested AST throws instead of overflowing the stack", (
   t.false(error instanceof RangeError, "should be a controlled error, not a stack overflow");
 });
 
+ava("cloning a deeply nested AST throws instead of overflowing the stack", (t) => {
+  const deep = buildDeepAst(1000);
+  const error = t.throws(() => deep.clone(), { instanceOf: Error });
+  t.false(error instanceof RangeError, "should be a controlled error, not a stack overflow");
+});
+
+ava("walking a deeply nested AST throws instead of overflowing the stack", (t) => {
+  const deep = buildDeepAst(1000);
+  const error = t.throws(() => deep.walk(() => {}), { instanceOf: Error });
+  t.false(error instanceof RangeError, "should be a controlled error, not a stack overflow");
+});
+
 ava("maxNestingDepth option controls the limit in both directions", (t) => {
   const input = nest(40);
   // A low limit rejects it and reports the configured value...

src/selectors/container.js

@@ -1,4 +1,4 @@
-import { resolveMaxNestingDepth } from "../util";
+import { resolveMaxNestingDepth, MAX_NESTING_DEPTH } from "../util";
 import Node from "./node";
 import * as types from "./types";
 
@@ -200,12 +200,19 @@ export default class Container extends Node {
     }
   }
 
-  walk(callback) {
+  walk(callback, depth = 0) {
+    // Bound recursion so a pathologically deep node tree raises a catchable
+    // error instead of overflowing the call stack (CVE-2026-9358 / CWE-674).
+    if (depth > MAX_NESTING_DEPTH) {
+      throw new Error(
+        `Cannot walk selector: nesting depth exceeds the maximum of ${MAX_NESTING_DEPTH}.`,
+      );
+    }
     return this.each((node, i) => {
       let result = callback(node, i);
 
       if (result !== false && node.length) {
-        result = node.walk(callback);
+        result = node.walk(callback, depth + 1);
       }
 
       if (result === false) {

src/selectors/node.js

@@ -1,6 +1,13 @@
-import { ensureObject } from "../util";
+import { ensureObject, MAX_NESTING_DEPTH } from "../util";
 
-let cloneNode = function (obj, parent) {
+let cloneNode = function (obj, parent, depth = 0) {
+  // Bound recursion so a pathologically deep node tree raises a catchable
+  // error instead of overflowing the call stack (CVE-2026-9358 / CWE-674).
+  if (depth > MAX_NESTING_DEPTH) {
+    throw new Error(
+      `Cannot clone selector: nesting depth exceeds the maximum of ${MAX_NESTING_DEPTH}.`,
+    );
+  }
   if (typeof obj !== "object" || obj === null) {
     return obj;
   }
@@ -19,9 +26,9 @@ let cloneNode = function (obj, parent) {
         cloned[i] = parent;
       }
     } else if (value instanceof Array) {
-      cloned[i] = value.map((j) => cloneNode(j, cloned));
+      cloned[i] = value.map((j) => cloneNode(j, cloned, depth + 1));
     } else {
-      cloned[i] = cloneNode(value, cloned);
+      cloned[i] = cloneNode(value, cloned, depth + 1);
     }
   }