CVE-2026-93749

source-map-js through 1.2.1 Event Loop Denial of Service

En bref

Sévérité: HIGH 8.7
EPSS: EPSS 0.46 % · centile 39 (2026-10-27)
État: PUBLISHED
Publiée: 2026-09-18
Mise à jour: 2026-09-24
Attribuée par: VulnCheck
Statut NVD: Awaiting Analysis

Description

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

Scores

Version	Score	Vecteur	Évalué par
CVSS 4.0	HIGH 8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	VulnCheck
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	VulnCheck
CVSS 4.0	HIGH 8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · disclosure@vulncheck.com (Secondary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · disclosure@vulncheck.com (Secondary)

Faiblesses (CWE)

CWE-1284

Avis

GHSA-68fv-2mgg-jv7q — source-map-js allows event-loop denial of service through indexed source-map section offsets

Références européennes

ENISA EUVD · EUVD-2026-83254
GCVE · GCVE-0-2026-93749

Avis du CERT-FR

CERTFR-2026-AVI-1378 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Produits affectés

Produit	Versions
7rulnik · source-map-js	affected 0 ≤ 1.2.1

Références

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD