AIKIDO-2026-223593

TL;DR

The CSS scrubber matches a declaration's property name with an unbounded pattern followed by a mandatory colon, so a long run of word characters not followed by a colon forces the regex engine to backtrack one character at a time and retry from every offset. The work grows quadratically with the length of the run, and no length cap is applied to the CSS handed to the scrubber. Sanitizing a large style value therefore consumes seconds of scheduler time and can saturate the scheduler pool, making the application unresponsive. The fix bounds the matching so long non-declaration input no longer triggers quadratic backtracking.