CVE-2026-124078

HIGH 7.5

plist.js before 5.0.1 Uncontrolled Resource Consumption via Binary Parser

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

plist.js (npm package 'plist') before 5.0.1 contains an uncontrolled resource consumption vulnerability in the binary property-list parser (parseBinary) that allows unauthenticated attackers to crash a Node.js process by exploiting unmemoized recursive resolution of shared object references for arrays and dictionaries. Attackers can craft a small binary plist (under 200 bytes) containing chained self-referencing object indices to trigger exponential (2^N) resolution calls and memory growth, causing an unrecoverable out-of-memory crash and denial of service.

CWE	CWE-776 CWE-674
Vendor	tootallnate
Product	plist.js
Published	Nov 6, 2026

Stay Ahead of the Next One

Get instant alerts for tootallnate plist.js

Be the first to know when new high vulnerabilities affecting tootallnate plist.js are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

TooTallNate / plist.js

0 < 5.0.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/TooTallNate/plist.js/releases/tag/plist%405.0.1 github.com: https://github.com/TooTallNate/plist.js/commit/ac871e67aa0b0440da50bf40d58c6deddce9d8c1 vulncheck.com: https://www.vulncheck.com/advisories/plist-js-before-uncontrolled-resource-consumption-via-binary-parser

Credits

Muhammadyusuf Dilmurodov (agrresore)