Every CVE Search/ Get API key

CVE-2026-93749

source-map-js through 1.2.1 Event Loop Denial of Service

8.7 HighFix available

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.46%Up 0.1 points since Sep 19, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

source-map-js through 1.2.1 Event Loop Denial of Service

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

Record
CVE-2026-93749
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1284
Updated
2026-11-02
EUVDEUVD-2026-83254 8.7

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

Record
EUVD-2026-83254
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-68fv-2mgg-jv7q 8.7

source-map-js allows event-loop denial of service through indexed source-map section offsets

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

Record
GHSA-68fv-2mgg-jv7q
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1284
Updated
2026-11-02
NVD 8.7

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

Record
CVE-2026-93749
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1284
Updated
2026-11-02
OSV 8.7

source-map-js through 1.2.1 Event Loop Denial of Service

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

Record
CVE-2026-93749
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-1284
Updated
2026-11-02
OSVDEBIAN-CVE-2026-93749 8.7

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

Record
DEBIAN-CVE-2026-93749
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-68fv-2mgg-jv7q 8.7

source-map-js allows event-loop denial of service through indexed source-map section offsets

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

Record
GHSA-68fv-2mgg-jv7q
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1284
Updated
2026-11-02
OSVUBUNTU-CVE-2026-93749 8.7

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

Record
UBUNTU-CVE-2026-93749
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-103442 No score

CVE-2026-93749 affecting package js-jquery 3.5.0-4

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

Record
AZL-103442
Updated
2026-11-05
OSVAZL-103478 No score

CVE-2026-93749 affecting package python-tensorboard 2.16.2-6

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

Record
AZL-103478
Updated
2026-11-02
OSVCLSA-2026-1792668516 No score

TuxCare security update for source-map-js (1 CVE)

TuxCare rebuilt source-map-js to address 1 CVE. Fixed in 1.2.1-tuxcare.1.

Record
CLSA-2026-1792668516
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-93749 No score

CVE-2026-93749 in source-map-js - Patched by Root

Root has patched CVE-2026-93749 in the source-map-js package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-93749
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
source-map-js
npm
 1.0.0 up to 1.2.2
1.2.2
js-jquery
Azure Linux:3
 through 3.5.0-4 None known
python-tensorboard
Azure Linux:3
 through 2.16.2-6 None known
source-map-js
TuxCare:npm
 1.2.1-tuxcare.0 up to 1.2.1-tuxcare.1, plus listed versions
1.2.1
1.2.1-tuxcare.1
node-postcss
Debian:12
 All versions, plus listed versions
8.4.20+~cs8.0.23-18.4.20+~cs8.0.23-1+deb12u18.4.31+~cs8.0.26-18.4.39+~cs9.2.29-18.4.49+~cs9.2.32-1
Show 15 moreShow less
8.5.12+~cs9.3.32-18.5.14+~cs9.3.34-18.5.15+~cs9.3.34-18.5.15+~cs9.3.38-18.5.15+~cs9.3.39-18.5.19+~cs10.2.23-18.5.21+~cs10.2.23-18.5.23+~cs10.2.23-18.5.25+~cs10.2.23-18.5.26+~cs10.2.24-18.5.28+~cs10.2.24-18.5.31+~cs10.2.26-18.5.6+~cs9.3.28-18.5.8+~cs9.3.30-18.5.9+~cs9.3.30-1
 None known
node-postcss
Debian:13
 All versions, plus listed versions
8.4.49+~cs9.2.32-18.5.12+~cs9.3.32-18.5.14+~cs9.3.34-18.5.15+~cs9.3.34-18.5.15+~cs9.3.38-1
Show 11 moreShow less
8.5.15+~cs9.3.39-18.5.19+~cs10.2.23-18.5.21+~cs10.2.23-18.5.23+~cs10.2.23-18.5.25+~cs10.2.23-18.5.26+~cs10.2.24-18.5.28+~cs10.2.24-18.5.31+~cs10.2.26-18.5.6+~cs9.3.28-18.5.8+~cs9.3.30-18.5.9+~cs9.3.30-1
 None known
node-postcss
Debian:14
 before 8.5.31+~cs10.2.26-1, plus listed versions
8.4.49+~cs9.2.32-18.5.12+~cs9.3.32-18.5.14+~cs9.3.34-18.5.15+~cs9.3.34-18.5.15+~cs9.3.38-1
Show 10 moreShow less
8.5.15+~cs9.3.39-18.5.19+~cs10.2.23-18.5.21+~cs10.2.23-18.5.23+~cs10.2.23-18.5.25+~cs10.2.23-18.5.26+~cs10.2.24-18.5.28+~cs10.2.24-18.5.6+~cs9.3.28-18.5.8+~cs9.3.30-18.5.9+~cs9.3.30-1
8.5.31+~cs10.2.26-1
source-map-js
Root:npm
 before 1.2.1-aikido.1
1.2.1-aikido.11.0.2-aikido.1
@rootio/source-map-js
Root:npm
 before 1.2.1-root.io.1
1.2.1-root.io.11.0.2-root.io.1
node-postcss
Ubuntu:20.04:LTS
 All versions, plus listed versions
6.0.23-16.0.23-3
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
node-postcss
Ubuntu:22.04:LTS
 All versions, plus listed versions
8.2.1+~cs5.3.23-88.4.5+~cs7.1.51-28.4.6+~cs7.3.21-1
 None known
node-postcss
Ubuntu:24.04:LTS
 All versions, plus listed versions
8.4.20+~cs8.0.23-18.4.31+~cs8.0.26-1
 None known
node-postcss
Ubuntu:26.10
 All versions, plus listed versions
8.5.8+~cs9.3.30-18.5.15+~cs9.3.34-18.5.15+~cs9.3.38-18.5.15+~cs9.3.39-1build18.5.25+~cs10.2.23-18.5.26+~cs10.2.24-1
 None known
node-postcss
Ubuntu:26.04:LTS
 All versions, plus listed versions
8.5.6+~cs9.3.28-18.5.8+~cs9.3.30-1
 None known

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-93749 is a high vulnerability (CVSS 8.7) in 7rulnik Source-map-js, published September 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. Fixed in source-map-js 1.2.2.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open