CVE-2026-93749: source-map-js Event-Loop Denial of Service Vulnerability
Summary
CVE-2026-93749: source-map-js allows event-loop denial of service through indexed source-map section offsets. Affects source-map-js versions >= 1.0.0, < 1.2.2. Fixed in 1.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
source-map-js is a JavaScript library that provides functionality for mapping compiled code back to the original source code. This is particularly useful for debugging minified or transpiled code. The library supports both indexed and non-indexed source maps, allowing developers to trace errors back to their original source files. However, a vulnerability has been identified in versions up to 1.2.1 that can lead to denial of service through improper handling of indexed source-map section offsets.
Vulnerability Detail
The vulnerability in source-map-js arises from its failure to validate the per-section offset line value in indexed source maps. Attackers can exploit this by supplying extremely large numeric values for offset lines, which can cause the event loop to block for extended periods. This results in the service being unable to handle other requests, leading to a denial of service. The issue is classified under CWE-1284, indicating a lack of proper validation and error handling.
How To Fix
Latest published version: 1.2.2 as of 22 Oct 2026
npm install source-map-js@1.2.2The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to restrict the size of offset values being processed. This can help mitigate the risk of denial of service until the package can be updated.
Conclusion
The source-map-js library has a critical vulnerability that can lead to denial of service through improper handling of indexed source-map section offsets. It is essential to update to version 1.2.2 or later to protect your application. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for source-map-js →
FAQ
The vulnerability has a CVSS score of 7.5, indicating a high severity level.
Versions of source-map-js up to and including 1.2.1 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If left unaddressed, this vulnerability can lead to denial of service, causing your application to become unresponsive and unable to handle requests.
Yes, implementing input validation to restrict the size of offset values can help mitigate the risk until you can update the package.
