CVE-2026-93749

HIGHCVSS 7.5

Description

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

Timeline

Published:September 18th, 2026 6:18 PM

Last modified:September 22nd, 2026 8:25 PM

CVSS Scoring

CVSS v3: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-1284

References & Reports

Advisories, patches, and third-party reports

https://github.com/7rulnik/source-map-js
https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118
https://github.com/7rulnik/source-map-js/issues/76
https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service

Source: NIST NVD · Data may lag official sources by up to one minute