EUVD-2026-83254Published
source-map-js through 1.2.1 Event Loop Denial of Service
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-93749 · Microsoft / collected KEV context
cve-program · CVE-2026-93749
- https://github.com/7rulnik/source-map-js/issues/76
- https://github.com/7rulnik/source-map-js
- https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118
- https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service
euvd · EUVD-2026-83254
- https://github.com/7rulnik/source-map-js/issues/76
- https://github.com/7rulnik/source-map-js
- https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118
- https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service
nvd · CVE-2026-93749
- https://github.com/7rulnik/source-map-js
- https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118
- https://github.com/7rulnik/source-map-js/issues/76
- https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service
osv · GHSA-68fv-2mgg-jv7q
- https://nvd.nist.gov/vuln/detail/CVE-2026-93749
- https://github.com/7rulnik/source-map-js/issues/76
- https://github.com/7rulnik/source-map-js/pull/79
- https://github.com/7rulnik/source-map-js/commit/cf7658058ceeaa8619d5ae0ec90be6905209d016
- https://github.com/7rulnik/source-map-js
- https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118
- https://github.com/7rulnik/source-map-js/releases/tag/v1.2.2
- https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service
Related operational evidence
Explicit CVE identifiers- source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous e… · Advisory content revised · 11 Nov 2026
- source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous e… · Advisory content revised · 1 Nov 2026