GitHub Advisoryadvisory · npm
GHSA-68fv-2mgg-jv7q source-map-js allows event-loop denial of service through indexed source-map section offsets
HIGH
Official page ↗
- Aliases
- CVE-2026-93749
- Ecosystem
- npm
- Packages
- source-map-js
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-1284
- Reviewed
- 2026-10-05
Affected packages
• npm source-map-js: >= 1.0.0, < 1.2.2 → fixed in 1.2.2
Description
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.
Related
Alias · CVE (1)
- CVE-2026-93749 source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify… vulnerability
Weakness · CWE (1)
- CWE-1284 Improper Validation of Specified Quantity in Input weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-93749 advisory
- https://github.com/7rulnik/source-map-js/issues/76 web
- https://github.com/7rulnik/source-map-js/pull/79 web
- https://github.com/7rulnik/source-map-js/commit/cf7658058ceeaa8619d5ae0ec90be6905209d016 web
- https://github.com/7rulnik/source-map-js package
- https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118 web
- https://github.com/7rulnik/source-map-js/releases/tag/v1.2.2 web
- https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service web