Description
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| 7rulnik | source-map-js | ≤ 1.2.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-postcss | 8.5.31+~cs10.2.26-1 | — |
| Debian 13 | node-postcss | No fix yet | — |
| Debian 12 | node-postcss | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-postcss | No fix yet | — |
| Ubuntu 26.04 LTS | node-postcss | No fix yet | — |
| Ubuntu 24.04 LTS | node-postcss | No fix yet | — |
| Ubuntu 22.04 LTS | node-postcss | No fix yet | — |
| Ubuntu 20.04 LTS | node-postcss | No fix yet | — |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | cockpit-image-builder | 110.3-1.el10_3 | RLSA-2026:98613 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | firefox | 140.17.0-1.amzn2023.0.1 | ALAS2023-2026-3214 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | js-jquery +1 | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jupyter-base-notebook | 7.6.3-r2 | — |
| Wolfi rolling | langfuse-3-worker | 3.225.11-r7 | — |
| Wolfi rolling | nextcloud-server-33 | 33.0.9-r5 | — |
| Wolfi rolling | opensearch-dashboards-3-dashboards-observability | 3.8.0-r11 | — |
| Wolfi rolling | rancher-api-ui | 1.2.3-r14 | — |
| Wolfi rolling | renovate | 44.133.0-r4 | — |
| Wolfi rolling | saf | 1.7.0-r3 | — |
| Wolfi rolling | vitess-23 | 23.0.7-r1 | — |
| Wolfi rolling | vitess-24 | 24.0.4-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | source-map-js | >= 1.0.0, < 1.2.2 | 1.2.2 | GHSA-68fv-2mgg-jv7q |
Advisories 4
- RLSA-2026:98613 Critical: cockpit-image-builder security update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2026-4410 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- WID-SEC-2026-4413 IBM QRadar SIEM (Log Source Management App): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- ALAS2023-2026-3214 Important: firefox security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 29, 2026
References
- GitHub Issue #76 issue-tracking
- https://github.com/7rulnik/source-map-js product
- line-padding loop driven by the unvalidated section offset line technical-description
- VulnCheck Advisory: source-map-js through 1.2.1 Event Loop Denial of Service third-party-advisory