Description
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.
Recommendation
Update the source-map-js package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.0.0, < 1.2.2
- Patched version(s): 1.2.2
References
Could your website be exposed too?
SmartScanner can check your website for source-map-js allows event-loop denial of service through indexed source-map section offsets and gives you actionable findings to investigate.
Start a free scanRelated Issues
- protobufjs: Denial of Service via infinite loop in .proto option parsing - CVE-2026-59877
- Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set - CVE-2026-59880
- @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service - CVE-2026-119202
- parse-duration has a Regex Denial of Service that results in event loop delay and out of memory - CVE-2025-25283
You might also like:
See something that needs correcting? Let us knowUpdated October 05, 2026