GHSA-68fv-2mgg-jv7q CVE-2026-93749
source-map-js allows event-loop denial of service through indexed source-map section offsets
- Severity
- 8.7 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.46%
- Chance of exploitation in the next 30 days. Higher than 39.51% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1284 Improper Validation of Specified Quantity in Input
- Fix
1.2.2- Upgrade source-map-js to this version or later
Description
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| source-map-js | >= 1.0.0, < 1.2.2 |
1.2.2 |
| source-map-js | >= 1.0.0, < 1.2.2 |
1.2.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
source-map-js npm → 1.2.2
- npm
npm install source-map-js@1.2.2- yarn
yarn add source-map-js@1.2.2- pnpm
pnpm add source-map-js@1.2.2
Severity breakdown
CVSS 4.0 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-1284: Improper Validation of Specified Quantity in Input
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
How to prevent it
- Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
References
Advisories
Fixes and patches
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-5cwg-6vw7-rj6p Forge: AES-GCM authentication bypass via unvalidated tagLength option | Medium | Same weakness, CWE-1284 |
| GHSA-jc66-7q78-782g Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count | High | Same weakness, CWE-1284 |
| GHSA-8hxf-qr8p-62x4 zip: AES Entry HMAC Authentication Bypass on Premature EOF | Medium | Same weakness, CWE-1284 |
| GHSA-ph72-cqr5-qpp7 vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features | Medium | Same weakness, CWE-1284 |
| EEF-CVE-2026-89420 Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free | Not rated yet | Same weakness, CWE-1284 |
| EEF-CVE-2026-82750 Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation | Not rated yet | Same weakness, CWE-1284 |
| EEF-CVE-2026-82751 Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning | Not rated yet | Same weakness, CWE-1284 |
| EEF-CVE-2026-82752 Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length | Not rated yet | Same weakness, CWE-1284 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor