CVE-2026-58505: geojson-vt: Uncontrolled Recursion in Nested GeoJSON GeometryCollection
geojson-vt is a JavaScript library for slicing GeoJSON data into vector tiles on the fly, primarily designed to enable rendering and interacting with large geospatial datasets on the browser side (without a server). Prior to version 6.1.1, @maplibre/geojson-vt contains an uncontrolled recursion vulnerability in its GeoJSON conversion logic. When a GeoJSONVT instance is constructed with a deeply nested GeometryCollection object, the mutually recursive functions featureToInternal and convertGeometryCollection in src/convert.ts exhaust the Node.js call stack, causing an unhandled RangeError: Maximum call stack size exceeded that terminates the process. Because the library is widely used in server-side tile services that accept GeoJSON over the network, a remote unauthenticated attacker can trigger a denial-of-service by sending a single crafted payload. No authentication is required, and no non-default library options are needed. This issue has been patched in version 6.1.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@maplibre/geojson-vtto a version that resolves this vulnerability.Fixed in 6.1.1
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Server-side tile services that accept GeoJSON over the network and construct GeoJSONVT instances are exposed. The issue can be triggered remotely with a single crafted payload; browser-side use is not identified as a remote attack path in the provided information.
Does exploitation require authentication or special library settings?
No. An unauthenticated attacker can exploit the issue, and no non-default library options are required.
What happens when exploitation succeeds?
A deeply nested GeometryCollection exhausts the Node.js call stack and raises an unhandled "RangeError: Maximum call stack size exceeded." This terminates the process, causing denial of service.
What version fixes the issue?
The issue is patched in @maplibre/geojson-vt version 6.1.1.