CVE-2026-93749: source-map-js through 1.2.1 Event Loop Denial of Service

Awaiting analysis

AliasesUBUNTU-CVE-2026-93749DEBIAN-CVE-2026-93749CGA-269c-w943-252m+177 more

Published 18-09-2026Last modified 24-09-2026

Vulnerability summary

CVE-2026-93749 is a high (CVSS 8.7) vulnerability in 7rulnik source-map-js. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 39.5% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 8.7 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

8.7/10

010

High · v4.0 (CVE.org)

EPSS score

0.46%

0%100%

Low · -0.17 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

18-09-2026
PublishedVulnerability first disclosed.
24-09-2026
Last modifiedVulnerability information updated.

Description

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

CVSS metrics

11 scores · 7 sources · 2 versions

v4.08.7v3.17.5

EPSS trend

Probability

0.46%

Chance of exploitation in the next 30 days

Percentile

40%

Versus all other CVEs

30-day change

Decrease -0.17 pp

From 0.63% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-1284Improper Validation of Specified Quantity in InputThe product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard60 products

airflow-2All versions (No fix recorded)
airflow-core-2All versions (No fix recorded)
arangodb-3.11All versions (No fix recorded)
arangodb-3.12< 3.12.12.1-r6
authentik-2025.12< 2025.12.6-r18

authentik-2026.2All versions (No fix recorded)
authentik-2026.5< 2026.5.7-r9
authentik-fips-2025.12All versions (No fix recorded)
authentik-fips-2026.2< 2026.2.7-r4
authentik-fips-2026.5< 2026.5.7-r11
commercial-gitlab-rails-ee-19.1< 19.1.7-r3
commercial-gitlab-rails-ee-19.2< 19.2.7-r1
commercial-gitlab-rails-ee-19.3< 19.3.3-r1
commercial-gitlab-rails-ee-19.4< 19.4.1-r1
commercial-gitlab-rails-ee-fips-19.1All versions (No fix recorded) | < 19.1.9-r0
commercial-gitlab-rails-ee-fips-19.2< 19.2.7-r1
commercial-gitlab-rails-ee-fips-19.3< 19.3.3-r1
commercial-gitlab-rails-ee-fips-19.4< 19.4.1-r1
gitlab-rails-ce-18.10All versions (No fix recorded)
gitlab-rails-ce-18.11All versions (No fix recorded) | < 18.11.13-r0
gitlab-rails-ce-18.8All versions (No fix recorded)
gitlab-rails-ce-18.9All versions (No fix recorded)
gitlab-rails-ce-19.0All versions (No fix recorded) | < 19.0.10-r0
gitlab-rails-ce-19.1All versions (No fix recorded) | < 19.1.9-r0
gitlab-rails-ce-19.2< 19.2.7-r9
gitlab-rails-ce-19.3All versions (No fix recorded) | < 19.3.5-r2
gitlab-rails-ce-19.4< 19.4.1-r7
gitlab-rails-ce-fips-18.10< 18.10.8-r8
gitlab-rails-ce-fips-18.11< 18.11.12-r2
gitlab-rails-ce-fips-18.8All versions (No fix recorded)
gitlab-rails-ce-fips-18.9< 18.9.8-r8
gitlab-rails-ce-fips-19.0< 19.0.9-r3
gitlab-rails-ce-fips-19.1< 19.1.8-r9
gitlab-rails-ce-fips-19.2< 19.2.7-r8
gitlab-rails-ce-fips-19.3< 19.3.3-r6
gitlab-rails-ce-fips-19.4< 19.4.1-r8
homepage< 2.4.0-r2
jupyter-base-notebook< 7.6.3-r2
keep-ui< 0.54.3-r6
keep-ui-fips< 0.54.3-r4
langfuse-3-worker< 3.225.11-r7
langfuse-4-worker< 4.50.0-r3
langfuse-fips-3-workerAll versions (No fix recorded) | < 3.225.11-r5
langfuse-fips-4-workerAll versions (No fix recorded) | < 4.49.0-r14
nextcloud-server-32All versions (No fix recorded)
nextcloud-server-33< 33.0.9-r5
nextcloud-server-34< 34.0.4-r7
nextcloud-server-35All versions (No fix recorded) | < 35.0.0-r3
opensearch-dashboards-3-dashboards-observability< 3.8.0-r11
opensearch-dashboards-3-fips-dashboards-observability< 3.8.0-r7
rancher-api-ui< 1.2.3-r14
renovateAll versions (No fix recorded) | < 44.133.0-r4
saf< 1.7.0-r3
semaphore< 2.19.12-r5
tensorflow-gpu-jupyter< 2.21.0-r12
unleash< 8.2.0-r6
unleash-fips< 8.2.0-r5
vitess-22< 22.0.4-r26
vitess-23< 23.0.7-r1
vitess-24< 24.0.4-r1

Show all 60

Wolfi9 products

jupyter-base-notebook< 7.6.3-r2
langfuse-3-worker< 3.225.11-r7
nextcloud-server-33< 33.0.9-r5
opensearch-dashboards-3-dashboards-observability< 3.8.0-r11
rancher-api-ui< 1.2.3-r14

Show all 9

7rulnik1 product

source-map-js≤ 1.2.1

Debian1 product

node-postcssAll versions (No fix recorded) | < 8.5.31+~cs10.2.26-1

Npm1 product

source-map-js≥ 1.0.0, < 1.2.2

Ubuntu1 product

node-postcssAll versions (No fix recorded)

6 vendors · 73 products

References

12 links

github.com/7rulnik/source-map-js/issues/76Issue TrackingREPORTWEB
github.com/7rulnik/source-map-jsProductREPORTPACKAGE
github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.jsTechnical DescriptionREPORTARTICLEWEB
www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-serviceThird Party AdvisoryREPORTAdvisoryWEB
ubuntu.com/security/CVE-2026-93749REPORT
www.cve.org/CVERecord?id=CVE-2026-93749REPORT
security-tracker.debian.org/tracker/CVE-2026-93749Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93749.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-93749Advisory
github.com/7rulnik/source-map-js/pull/79WEB

Show all 12 references