@@ -47,6 +47,18 @@ ava('serializing a deeply nested AST throws instead of overflowing the stack', t
     t.false(error instanceof RangeError, 'should be a controlled error, not a stack overflow');
 });
 
+ava('cloning a deeply nested AST throws instead of overflowing the stack', t => {
+    const deep = buildDeepAst(1000);
+    const error = t.throws(() => deep.clone(), {instanceOf: Error});
+    t.false(error instanceof RangeError, 'should be a controlled error, not a stack overflow');
+});
+
+ava('walking a deeply nested AST throws instead of overflowing the stack', t => {
+    const deep = buildDeepAst(1000);
+    const error = t.throws(() => deep.walk(() => {}), {instanceOf: Error});
+    t.false(error instanceof RangeError, 'should be a controlled error, not a stack overflow');
+});
+
 ava('maxNestingDepth option controls the limit in both directions', t => {
     const input = nest(40);
     // A low limit rejects it and reports the configured value...
 
@@ -1,4 +1,4 @@
-import {resolveMaxNestingDepth} from '../util';
+import {resolveMaxNestingDepth, MAX_NESTING_DEPTH} from '../util';
 import Node from './node';
 import * as types from './types';
 
@@ -189,12 +189,19 @@ export default class Container extends Node {
         }
     }
 
-    walk (callback) {
+    walk (callback, depth = 0) {
+        // Bound recursion so a pathologically deep node tree raises a catchable
+        // error instead of overflowing the call stack (CVE-2026-9358 / CWE-674).
+        if (depth > MAX_NESTING_DEPTH) {
+            throw new Error(
+                `Cannot walk selector: nesting depth exceeds the maximum of ${MAX_NESTING_DEPTH}.`
+            );
+        }
         return this.each((node, i) => {
             let result = callback(node, i);
 
             if (result !== false && node.length) {
-                result = node.walk(callback);
+                result = node.walk(callback, depth + 1);
             }
 
             if (result === false) {
 
@@ -1,6 +1,13 @@
-import {ensureObject} from "../util";
+import {ensureObject, MAX_NESTING_DEPTH} from "../util";
 
-let cloneNode = function (obj, parent) {
+let cloneNode = function (obj, parent, depth = 0) {
+    // Bound recursion so a pathologically deep node tree raises a catchable
+    // error instead of overflowing the call stack (CVE-2026-9358 / CWE-674).
+    if (depth > MAX_NESTING_DEPTH) {
+        throw new Error(
+            `Cannot clone selector: nesting depth exceeds the maximum of ${MAX_NESTING_DEPTH}.`
+        );
+    }
     if (typeof obj !== 'object' || obj === null) {
         return obj;
     }
@@ -19,9 +26,9 @@ let cloneNode = function (obj, parent) {
                 cloned[i] = parent;
             }
         } else if ( value instanceof Array ) {
-            cloned[i] = value.map( j => cloneNode(j, cloned) );
+            cloned[i] = value.map( j => cloneNode(j, cloned, depth + 1) );
         } else {
-            cloned[i] = cloneNode(value, cloned);
+            cloned[i] = cloneNode(value, cloned, depth + 1);
         }
     }