REDHAT-BUG-2538368: High severity npm/source-map-js vulnerability

Q: Which versions are affected?

source-map-js versions through 1.2.1 are affected.

Q: What access does an attacker need to trigger the issue?

The attacker must be able to supply an indexed source map to the application or service that processes it.

Q: What is the operational impact of successful exploitation?

Extremely large per-section offset line values can synchronously block the event loop for an extended period, preventing the service from handling other requests.

Published Sep 22, 2026

Updated

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

Affected Software

1 affected component

npm/source-map-js<=1.2.1

Event History

Sep 22, 2026

Data Sourced

via Red Hat·06:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which versions are affected?

source-map-js versions through 1.2.1 are affected.

What access does an attacker need to trigger the issue?

The attacker must be able to supply an indexed source map to the application or service that processes it.

What is the operational impact of successful exploitation?

Extremely large per-section offset line values can synchronously block the event loop for an extended period, preventing the service from handling other requests.

REDHAT-BUG-2538368: High severity npm/source-map-js vulnerability

Affected Software

Event History

Frequently Asked Questions

Which versions are affected?

What access does an attacker need to trigger the issue?

What is the operational impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which versions are affected?

What access does an attacker need to trigger the issue?

What is the operational impact of successful exploitation?