Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882

[MoOx]

Closes #315

The fix basically prevent stack overflow on deeply nested selectors (CVE-2026-9358)

Deeply nested selectors (e.g. :not(:not(:not(…)))) caused uncontrolled recursion in both parsing and toString() serialization, overflowing the call stack with an uncatchable RangeError (CWE-674 / SNYK-JS-POSTCSSSELECTORPARSER-16873882).

Add a nesting-depth limit (default 256, far beyond any real selector) that raises a clear, catchable Error instead of crashing:

• bound parenthesis nesting during parsing
• bound recursion during pseudo serialization
• expose a configurable maxNestingDepth parser option

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds AVA regression coverage to ensure deeply nested selectors no longer cause uncontrolled recursion/stack overflow (CVE-2026-9358 / SNYK-JS-POSTCSSSELECTORPARSER-16873882), and that failures surface as catchable errors.

Changes:

• Adds parse-time regression tests for deeply nested :not(...) selectors exceeding the maximum depth.
• Adds serialization (toString) regression test by building a deep AST that bypasses parsing guards.
• Adds tests for the maxNestingDepth option (tightening and loosening the limit).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 4 comments.