CVE-2026-93749

7.5 HIGHpublic exploit available

Published 2026-09-18 · Updated 2026-09-22

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-1284

Public exploit & PoC references

https://github.com/7rulnik/source-map-js
https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118
https://github.com/7rulnik/source-map-js/issues/76

All references

https://github.com/7rulnik/source-map-js
https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118
https://github.com/7rulnik/source-map-js/issues/76
https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2025-36178
UNSCOREDCVE-2026-102711PoC
UNSCOREDCVE-2026-102730PoC
UNSCOREDCVE-2026-12974
HIGHCVE-2026-70378PoC
MEDIUMCVE-2026-73436
MEDIUMCVE-2026-75806PoC
MEDIUMCVE-2026-76899PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.