CVE-2026-93749

HIGH 7.5

source-map-js through 1.2.1 Event Loop Denial of Service

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

CWE	CWE-1284
Vendor	7rulnik
Product	source-map-js
Published	Sep 18, 2026

Stay Ahead of the Next One

Get instant alerts for 7rulnik source-map-js

Be the first to know when new high vulnerabilities affecting 7rulnik source-map-js are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

7rulnik / source-map-js

0 ≤ 1.2.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/7rulnik/source-map-js/issues/76 github.com: https://github.com/7rulnik/source-map-js github.com: https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118 vulncheck.com: https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service

Credits

🔍 Wayde Shi (PayPal Cyber Security Team)