GHSA-68fv-2mgg-jv7q
source-map-js allows event-loop denial of service through indexed source-map section offsets
At a glance
- Published
- Updated
- CVE
- CVE-2026-93749
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Description
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.
Affected packages
| Package | Versions |
|---|---|
| npm · source-map-js | introduced 1.0.0, fixed 1.2.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-93749 ADVISORY
- https://github.com/7rulnik/source-map-js/issues/76 WEB
- https://github.com/7rulnik/source-map-js/pull/79 WEB
- https://github.com/7rulnik/source-map-js/commit/cf7658058ceeaa8619d5ae0ec90be6905209d016 WEB
- https://github.com/7rulnik/source-map-js PACKAGE
- https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118 WEB
- https://github.com/7rulnik/source-map-js/releases/tag/v1.2.2 WEB
- https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |