CVE-2026-93749 in source-map-js
Summary
by MITRE • 09/18/2026
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in source-map-js versions through 1.2.1 centers on a critical input validation failure within the parser logic responsible for processing indexed source maps. Indexed source maps are a compact format used to map minified or compiled code back to its original source files, facilitating debugging and error tracking in modern web development environments. The specific flaw lies in the handling of per-section offset line values during the parsing process. When an attacker supplies a crafted source map containing extremely large numeric values for these offsets, the library fails to enforce reasonable bounds on this input. This lack of validation allows malicious actors to inject data that triggers inefficient computational behavior within the parser's internal algorithms.
The operational impact of this vulnerability is severe due to its potential to cause synchronous event loop blocking in Node.js environments and similar single-threaded execution contexts. Because source-map-js operates synchronously during the parsing phase, an excessively large offset value forces the engine to perform a disproportionate amount of work before returning control to the event loop. This results in extended periods where the application is unresponsive, effectively creating a Denial of Service condition. Legitimate users attempting to access services that rely on this library for source map resolution will experience significant latency or complete service outage until the malicious parsing operation completes or times out.
From a classification perspective, this issue aligns with CWE-20 Improper Input Validation and CWE-400 Uncontrolled Resource Consumption. The failure to validate the magnitude of numeric inputs allows an attacker to exhaust system resources, specifically CPU cycles and time, which are critical for maintaining service availability. In terms of attack vectors, this vulnerability can be leveraged within the context of ATT&CK technique T1496 Resource Hijacking or more broadly as a Denial of Service vector under T1499 Endpoint Denial of Service if it leads to system instability. It is particularly dangerous in server-side rendering scenarios or build pipelines where source maps are processed automatically without user intervention, making the attack surface broader and potentially easier to exploit at scale.
Mitigation strategies should prioritize immediate updates to version 1.2.2 or later of source-map-js, which addresses this validation gap by implementing strict bounds checking on offset line values. For applications unable to update immediately due to dependency constraints, developers can implement a custom parser wrapper that validates the structure and numeric ranges of incoming source maps before passing them to the library. Additionally, integrating Web Application Firewalls or input sanitization layers that detect anomalously large JSON payloads containing source map data can provide an additional layer of defense against exploitation attempts targeting this specific parsing logic.