All vulnerabilities
CVE-2026-93749GHSA-68fv-2mgg-jv7q

source-map-js allows event-loop denial of service through indexed source-map section offsets

7rulnik source-map-jsnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.35%Chance of exploitation activity in the next 30 days, higher than 26% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.2.2Fixed versionGitHub
Published18 Sep 2026Updated 5 Oct 2026CVE List

What fixes it

  • 1.2.2source-map-js, npmGitHubnpm install source-map-js@1.2.2

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

Text from CVE List

Affected versions 3

  • source-map-js, npm>= 1.0.0, < 1.2.2GitHub
  • source-map-jsaffected: all versions through 1.2.1CVE List
  • source-map-js, npmfrom 1.0.0, fixed in 1.2.2OSV

References 9