Configure maxNestingDepth to prevent stack overflow
mainTo protect against Denial-of-Service (DoS) attacks via deeply nested selectors (e.g., thousands of :not() pseudo-classes), the parser uses a nesting depth limit.
- Default limit:
256. - Behavior: If nesting exceeds the limit, the parser throws a catchable
Errorinstead of aRangeError: Maximum call stack size exceeded. - Customization: You can tighten this limit when processing untrusted input by passing the
maxNestingDepthoption to.processSync()or.process().
Warning: Raising this value to an extremely high number in environments with small call stacks (like browser workers) may reintroduce stack overflow risks.
// Tighten the limit when parsing untrusted input:
parser().processSync(untrustedSelector, {maxNestingDepth: 128});