CVE-2026-93749: source-map-js DOS Vulnerability

CVE-2026-93749 Overview

CVE-2026-93749 is a denial-of-service vulnerability in the source-map-js package through version 1.2.1. The library fails to validate the per-section offset line value in indexed source maps. Attackers can supply arbitrary numeric values in this field, including extremely large integers.

When the library processes a crafted indexed source map, it blocks the Node.js event loop synchronously for extended periods. This prevents the affected service from handling other concurrent requests. The flaw is categorized as improper validation specified in inputs to a downstream component [CWE-1284].

Critical Impact
Remote unauthenticated attackers can freeze Node.js services that parse untrusted source maps, causing sustained availability loss.

Affected Products

source-map-js package versions through 1.2.1
Node.js applications and build tools that parse untrusted indexed source maps
Web frameworks and bundlers that transitively depend on source-map-js

Discovery Timeline

2026-09-18 - CVE-2026-93749 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93749

Vulnerability Analysis

The source-map-js library parses source map files that map minified JavaScript back to original source code. Indexed source maps use a sectioned format where each section declares an offset with line and column fields. The library treats the line value as a trusted numeric input and iterates over it without bounds checking.

When an attacker submits an indexed source map with an offset line value of, for example, 2^30 or higher, the parser enters a tight synchronous loop. Node.js executes user code on a single event loop thread. A long synchronous computation blocks all other request handlers, timers, and I/O callbacks until the loop completes.

The vulnerable code path is in lib/source-node.js, referenced in the upstream repository. Reference material is available in the VulnCheck advisory for source-map-js and GitHub issue #76.

Root Cause

The root cause is missing validation of numeric bounds on the per-section offset.line field during indexed source map processing. The parser assumes well-formed producer output and does not enforce a maximum value or sanity-check the field against the size of the underlying source content.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker sends a malformed indexed source map to any endpoint or process that invokes source-map-js for parsing. Typical targets include error-reporting backends, live-debugging tunnels, build pipelines that accept remote source maps, and browser developer tooling services. Each malicious payload blocks the event loop, and repeated submission sustains the denial of service.

No verified public proof-of-concept code is available. See the source-node.js code reference for the affected loop.

Detection Methods for CVE-2026-93749

Indicators of Compromise

Sustained CPU saturation on a Node.js process combined with a stalled event loop and rising request latency
Inbound HTTP requests carrying JSON payloads with the sections key and abnormally large offset.line values
Application logs showing timed-out downstream calls originating from source-map processing routes

Detection Strategies

Instrument source-map parsing routines with an event loop lag monitor and alert when lag exceeds an operational threshold
Inspect ingress payloads that contain source map JSON for numeric fields exceeding a reasonable maximum, such as 10^6
Add dependency scanning to CI/CD to flag source-map-js versions through 1.2.1 in package-lock.json and yarn.lock

Monitoring Recommendations

Track process-level metrics for event loop lag, request queue depth, and 5xx error rates on services that parse user-supplied source maps
Enable rate limiting and request-size limits on endpoints that accept source map uploads and alert on sudden spikes from single sources
Correlate application performance monitoring traces with WAF logs to identify request patterns that trigger long synchronous execution

How to Mitigate CVE-2026-93749

Immediate Actions Required

Inventory all direct and transitive uses of source-map-js with npm ls source-map-js and prioritize services that process untrusted input
Reject or sanitize indexed source maps from untrusted origins at the network edge until a patched version is deployed
Wrap source-map parsing in worker threads or child processes so a blocked event loop does not affect the main request handler

Patch Information

At the time of publication, no fixed version has been listed in NVD. Track the source-map-js GitHub repository and the VulnCheck advisory for the release that introduces bounds validation on the per-section offset line value. Upgrade to the fixed release once available and rebuild all downstream artifacts.

Workarounds

Validate incoming source map JSON before parsing and reject payloads whose sections[].offset.line exceeds a defined maximum
Offload source map parsing to a dedicated worker with a strict CPU time budget and terminate long-running jobs
Restrict source-map processing endpoints to authenticated internal callers and apply per-client rate limits

bash

# Configuration example: enumerate and audit source-map-js usage
npm ls source-map-js
npm audit --production
# Example input guard applied before invoking the parser
node -e "const s=require('fs').readFileSync(process.argv[1],'utf8');const j=JSON.parse(s);(j.sections||[]).forEach(x=>{if((x.offset&&x.offset.line)>1e6)throw new Error('offset.line too large')});" ./map.json