CVE-2026-124078: plist.js before 5.0.1 Uncontrolled Resource Consumption via Binary Parser
plist.js (npm package 'plist') before 5.0.1 contains an uncontrolled resource consumption vulnerability in the binary property-list parser (parseBinary) that allows unauthenticated attackers to crash a Node.js process by exploiting unmemoized recursive resolution of shared object references for arrays and dictionaries. Attackers can craft a small binary plist (under 200 bytes) containing chained self-referencing object indices to trigger exponential (2^N) resolution calls and memory growth, causing an unrecoverable out-of-memory crash and denial of service.
Event History
Frequently Asked Questions
Which applications are exposed to this denial-of-service issue?
Node.js applications using plist.js versions before 5.0.1 are exposed when they parse attacker-controlled binary plist data through the parseBinary parser. The affected input can be smaller than 200 bytes.
What does an attacker need to exploit the vulnerability?
An attacker needs only the ability to supply a crafted binary plist to a vulnerable application's parsing path. The described attack is unauthenticated and uses chained self-referencing object indices in arrays or dictionaries.
What is the impact of successful exploitation?
The crafted plist triggers exponential recursive object-resolution calls and memory growth. This can cause an unrecoverable out-of-memory crash of the Node.js process, resulting in denial of service.
What version resolves the issue?
Update plist.js to version 5.0.1 or later. Versions before 5.0.1 are identified as affected.