{"id":"CVE-2026-93749","title":"source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values","summary":"source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronou…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-1284","CWE-1285"],"vendor":"7rulnik","product":"source-map-js","affected":["source-map-js <= 1.2.1"],"published":"2026-09-18","updated":"2026-09-22","sourceUpdated":"2026-09-22T20:25:55.870","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93749","references":[{"url":"https://github.com/7rulnik/source-map-js","label":"disclosure@vulncheck.com"},{"url":"https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118","label":"disclosure@vulncheck.com"},{"url":"https://github.com/7rulnik/source-map-js/issues/76","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service","label":"disclosure@vulncheck.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93749.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-93749"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538368"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93749"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93749"},{"url":"https://github.com/7rulnik/source-map-js/pull/79"},{"url":"https://github.com/7rulnik/source-map-js/commit/cf7658058ceeaa8619d5ae0ec90be6905209d016"},{"url":"https://github.com/7rulnik/source-map-js/releases/tag/v1.2.2"},{"url":"https://github.com/advisories/GHSA-68fv-2mgg-jv7q"},{"url":"https://access.redhat.com/errata/RHSA-2026:79357"},{"url":"https://access.redhat.com/errata/RHSA-2026:84734"},{"url":"https://access.redhat.com/errata/RHSA-2026:83598"},{"url":"https://access.redhat.com/errata/RHSA-2026:86675"},{"url":"https://access.redhat.com/errata/RHSA-2026:85846"},{"url":"https://access.redhat.com/errata/RHSA-2026:88198"},{"url":"https://access.redhat.com/errata/RHSA-2026:87410"},{"url":"https://access.redhat.com/errata/RHSA-2026:86891"}],"tags":["nvd","cve.org","csaf","vex","red-hat","ghsa","npm"],"epss":0.00455,"epssPercentile":0.39329,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-22T15:16:45.824265Z"},"ingestedAt":"2026-09-18T18:47:53.268Z","aliases":["GHSA-68fv-2mgg-jv7q"],"ecosystem":"npm","patched":["source-map-js 1.2.2"],"slug":"CVE-2026-93749","body":"## Overview\n\nsource-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Node HealthCheck Operator, OpenShift Lightspeed, OpenShift Pipelines, Red Hat AMQ Broker 7, Red Hat Ansible Automation Platform 2, Red Hat build of Apache Camel - HawtIO 4, … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Data Grid 8, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Hardened Images, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93749.json)\n- **RHSA-2026:79357** · Red Hat · fixed in: Red Hat Cost Management On-Premise 1 · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:79357)\n- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)\n- **RHSA-2026:83598** · Red Hat · fixed in: Red Hat Trusted Artifact Signer 1.4 · released 2026-10-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:83598)\n- **RHSA-2026:86675** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:86675)\n- **RHSA-2026:85846** · Red Hat · fixed in: Red Hat Migration Toolkit 1.8 · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:85846)\n- **RHSA-2026:88198** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88198)\n- **RHSA-2026:87410** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87410)\n- **RHSA-2026:86891** · Red Hat · fixed in: Red Hat OpenShift AI 3.5 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:86891)\n\n## Package advisory (CVE-2026-93749)\n\nAffected packages:\n\n- `source-map-js >= 1.0.0, < 1.2.2`\n\nPatched in:\n\n- `source-map-js 1.2.2`\n\nSource: https://github.com/advisories/GHSA-68fv-2mgg-jv7q","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}