Uncontrolled recursion DoS in JustHTML() via deeply nested HTML

Summary justhtml through 1.9.1 allows denial of service via deeply nested HTML. During parsing, JustHTML.init always reaches TreeBuilder.finish, which unconditionally calls populateselectedcontent. That function recursively traverses the DOM via findelements / findelement without a depth bound,...

PT-2026-28775

Summary justhtml through 1.9.1 allows denial of service via deeply nested HTML. During parsing, JustHTML. init always reaches TreeBuilder.finish, which unconditionally calls populate selectedcontent. That function recursively traverses the DOM via find elements / find element without a depth boun...

PT-2026-79778

Name of the Vulnerable Software and Affected Versions justhtml versions prior to 1.10.0 Description Uncontrolled recursion occurs during the construction of JustHTML, where the TreeBuilder.finish function calls populate selectedcontent. This process recursively traverses the DOM tree using find...