CSSOM EUVD-2026-83257

Requires the host application to (1) pass attacker-controlled CSS into CSSOM's CSSStyleDeclaration.setProperty()/stylesheet parsing, and (2) subsequently serialize the parsed declaration via cssText, which is where the oversized allocation occurs. The specific trigger is a CSS declaration using the reserved name 'length', which is not validated and overwrites the internal length counter. Limiting factors: the library is not itself network-exposed, so exploitation is gated on an application feeding it untrusted stylesheet input and then serializing; deployments that only parse trusted/first-party CSS or never call cssText on attacker input are not exposed. Affected versions are CSSOM through 0.5.0.

This is a genuine but conditionally-reachable denial-of-service issue, not a top-tier priority. The vendor CVSS 4.0 vector (8.7, AV:N/AC:L/PR:N/UI:N/VA:H) is a pure-availability score with confidentiality and integrity explicitly zero (VC:N/VI:N), so the '8.7 High' rating derives entirely from process-crash impact - there is no data exposure or code execution. CWE-915 (improper control of a dynamically-determined object attribute) is the correct root cause: an attacker-controlled property name 'length' overwrites the object's internal counter. Critically, the network/unauthenticated framing assumes the host application feeds attacker-supplied CSS through CSSOM and then serializes it via cssText; the library itself is not a network service, so real-world reachability depends on the embedding application. No EPSS score, no CISA KEV listing, and no published proof-of-concept are present in the input - this is 'no public exploit identified at time of analysis.' The signals are consistent (single-source, availability-only, no exploitation evidence), so there is no CVSS-vs-EPSS or vector-vs-description conflict to flag; the main caveat is that AV:N presumes untrusted-CSS ingestion that only some deployments actually perform.

An application uses CSSOM to parse CSS supplied by an untrusted party (e.g., user-submitted stylesheets, scraped/remote HTML processed via a DOM emulator) and later serializes the parsed rules back to text. The attacker submits a stylesheet containing a declaration named 'length', which replaces CSSStyleDeclaration's internal length counter and forces a huge memory allocation during cssText serialization, terminating the Node.js process. No proof-of-concept is published in the provided sources.