The weakness lies in the toString method of the container.js module that serializes the AST back into text. A crafted CSS input can cause the method to recurse without bound, exhausting stack space or CPU cycles. This flaw leads to a denial‑of‑service condition that may be triggered remotely when the server compiles user‑supplied CSS. The issue is categorized under CWE‑404 and CWE‑674. Existing evidence indicates that the exploit is publicly disclosed, although no verified public code has been seen at this time.

Any system using the PostCSS library, with versions up to and including 7.1.1, is affected. The vulnerability manifests when the library processes external CSS, typically in web servers, build pipelines, or content‑management systems that rely on PostCSS to generate styles.

The CVSS score of 5.3 labels the weakness as a moderate impact. An attacker does not need local privileges; the vulnerability can be triggered remotely simply by providing a malicious stylesheet to the server. Because the EPSS score is not available and the issue is not listed in KEV, there is no current evidence of widespread exploitation, but the public disclosure suggests a potential for future attacks. The danger lies in the nondeterministic recursion, which can lead to service slowdown or crash when the server attempts to render the CSS.