CVE-2026-4671 - justhtml before 1.18.0 Denial of Service via CSS Selector
Brief
CVE ID : CVE-2026-4671
Published : Aug. 23, 2026, 2:16 p. m.
- 6 hours, 54 minutes ago
Description : justhtml before 1.
- 0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification.
Applications that evaluate attacker-controlled selector strings (via query(), matches(), or selector-based transforms), run selector matching over very large untrusted documents, construct DOM trees from untrusted structure, or enable linkification over attacker-controlled text may consume disproportionate CPU or memory.
Triggers include oversized selectors, large selector lists, oversized compound selectors, long combinator chains, deeply nested functional pseudo-classes, repeated token/positional matching, cyclic DOM graphs causing non-terminating traversal, and punctuation-heavy or trailing-bracket linkification input.