MapLibre geojson-vt up to 6.1.0 GeoJSON Conversion src/convert.ts featureToInternal/convertGeometryCollection recursion

Summaryinfo

A vulnerability was found in MapLibre geojson-vt up to 6.1.0. It has been classified as problematic. This issue affects the function featureToInternal/convertGeometryCollection of the file src/convert.ts of the component GeoJSON Conversion. The manipulation leads to recursion. This vulnerability is listed as CVE-2026-58505. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in MapLibre geojson-vt up to 6.1.0. It has been rated as problematic. This issue affects the function featureToInternal/convertGeometryCollection of the file src/convert.ts of the component GeoJSON Conversion. The manipulation with an unknown input leads to a recursion vulnerability. Using CWE to declare the problem leads to CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. Impacted is availability. The summary by CVE is:

geojson-vt is a JavaScript library for slicing GeoJSON data into vector tiles on the fly, primarily designed to enable rendering and interacting with large geospatial datasets on the browser side (without a server). Prior to version 6.1.1, @maplibre/geojson-vt contains an uncontrolled recursion vulnerability in its GeoJSON conversion logic. When a GeoJSONVT instance is constructed with a deeply nested GeometryCollection object, the mutually recursive functions featureToInternal and convertGeometryCollection in src/convert.ts exhaust the Node.js call stack, causing an unhandled RangeError: Maximum call stack size exceeded that terminates the process. Because the library is widely used in server-side tile services that accept GeoJSON over the network, a remote unauthenticated attacker can trigger a denial-of-service by sending a single crafted payload. No authentication is required, and no non-default library options are needed. This issue has been patched in version 6.1.1.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-58505 since 06/30/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 6.1.1 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• MapLibre

Name

• geojson-vt

Version

• 6.0
• 6.1.0

Website

• Product: https://github.com/maplibre/geojson-vt/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion