---
id: CVE-2026-93749
title: >-
  source-map-js through 1.2.1 fails to validate the per-section offset line
  value in indexed source maps, allowing attackers to specify arbitrary numeric
  values
summary: >-
  source-map-js through 1.2.1 fails to validate the per-section offset line
  value in indexed source maps, allowing attackers to specify arbitrary numeric
  values. Attackers can supply extremely large offset line values that cause
  synchronou…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-1284
  - CWE-1285
vendor: 7rulnik
product: source-map-js
affected:
  - source-map-js <= 1.2.1
published: '2026-09-18'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:25:55.870'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93749'
references:
  - url: 'https://github.com/7rulnik/source-map-js'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118
    label: disclosure@vulncheck.com
  - url: 'https://github.com/7rulnik/source-map-js/issues/76'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service
    label: disclosure@vulncheck.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93749.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-93749'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2538368'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-93749'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93749'
  - url: 'https://github.com/7rulnik/source-map-js/pull/79'
  - url: >-
      https://github.com/7rulnik/source-map-js/commit/cf7658058ceeaa8619d5ae0ec90be6905209d016
  - url: 'https://github.com/7rulnik/source-map-js/releases/tag/v1.2.2'
  - url: 'https://github.com/advisories/GHSA-68fv-2mgg-jv7q'
  - url: 'https://access.redhat.com/errata/RHSA-2026:79357'
  - url: 'https://access.redhat.com/errata/RHSA-2026:84734'
  - url: 'https://access.redhat.com/errata/RHSA-2026:83598'
  - url: 'https://access.redhat.com/errata/RHSA-2026:86675'
  - url: 'https://access.redhat.com/errata/RHSA-2026:85846'
  - url: 'https://access.redhat.com/errata/RHSA-2026:88198'
  - url: 'https://access.redhat.com/errata/RHSA-2026:87410'
  - url: 'https://access.redhat.com/errata/RHSA-2026:86891'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - ghsa
  - npm
epss: 0.00455
epssPercentile: 0.39329
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-22T15:16:45.824265Z'
ingestedAt: '2026-09-18T18:47:53.268Z'
aliases:
  - GHSA-68fv-2mgg-jv7q
ecosystem: npm
patched:
  - source-map-js 1.2.2
---

## Overview

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Node HealthCheck Operator, OpenShift Lightspeed, OpenShift Pipelines, Red Hat AMQ Broker 7, Red Hat Ansible Automation Platform 2, Red Hat build of Apache Camel - HawtIO 4, … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Data Grid 8, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Hardened Images, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93749.json)
- **RHSA-2026:79357** · Red Hat · fixed in: Red Hat Cost Management On-Premise 1 · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:79357)
- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)
- **RHSA-2026:83598** · Red Hat · fixed in: Red Hat Trusted Artifact Signer 1.4 · released 2026-10-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:83598)
- **RHSA-2026:86675** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:86675)
- **RHSA-2026:85846** · Red Hat · fixed in: Red Hat Migration Toolkit 1.8 · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:85846)
- **RHSA-2026:88198** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88198)
- **RHSA-2026:87410** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87410)
- **RHSA-2026:86891** · Red Hat · fixed in: Red Hat OpenShift AI 3.5 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:86891)

## Package advisory (CVE-2026-93749)

Affected packages:

- `source-map-js >= 1.0.0, < 1.2.2`

Patched in:

- `source-map-js 1.2.2`

Source: https://github.com/advisories/GHSA-68fv-2mgg-jv7q