CVE-2026-93749

About vulnerability

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

Affected product:

AlmaLinux 9.2 ESU , TuxCare 9.6 ESU , TuxCare 9.8 ESU , Vue , autoprefixer , babel-preset-expo , bramus/specificity , build , core , css-blank-pseudo , css-declaration-sorter , css-has-pseudo , css-loader , css-minimizer-webpack-plugin , css-prefers-color-scheme , css-tree , cssnano , cssnano-preset-advanced , cssnano-preset-default , cssnano-utils , csso , cssstyledeclaration , csstools-cascade-layer-name-parser , csstools-color-helpers , csstools-css-color-parser , csstools-postcss-alpha-function , csstools-postcss-cascade-layers , csstools-postcss-color-function , csstools-postcss-color-function-display-p3-linear , csstools-postcss-color-mix-function , csstools-postcss-color-mix-variadic-function-arguments , csstools-postcss-content-alt-text , csstools-postcss-contrast-color-function , csstools-postcss-hwb-function , csstools-postcss-ic-unit , csstools-postcss-initial , csstools-postcss-is-pseudo-class , csstools-postcss-light-dark-function , csstools-postcss-logical-float-and-clear , csstools-postcss-logical-overflow , csstools-postcss-logical-overscroll-behavior , csstools-postcss-logical-resize , csstools-postcss-logical-viewport-units , csstools-postcss-media-minmax , csstools-postcss-media-queries-aspect-ratio-number-values , csstools-postcss-nested-calc , csstools-postcss-oklab-function , csstools-postcss-position-area-property , csstools-postcss-property-rule-prelude-list , csstools-postcss-random-function , csstools-postcss-relative-color-syntax , csstools-postcss-scope-pseudo-class , csstools-postcss-sign-functions , csstools-postcss-stepped-value-functions , csstools-postcss-syntax-descriptor-syntax-production , csstools-postcss-system-ui-font-family , csstools-postcss-text-decoration-shorthand , csstools-postcss-todo-or-die , csstools-postcss-trigonometric-functions , csstools-postcss-unset-value , csstools-stylelint-no-invalid-at-import-rules-when-bundling , dart-sass , detective-postcss , detective-vue2 , docusaurus , docusaurus-bundler , docusaurus-core , docusaurus-cssnano-preset , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-google-gtag , docusaurus-theme-common , docusaurus-theme-search-algolia , domselector , expo , expo-app-integrity , expo-asset , expo-auth-session , expo-background-fetch , expo-blur , expo-config , expo-constants , expo-crypto , expo-file-system , expo-font , expo-glass-effect , expo-image , expo-intent-launcher , expo-keep-awake , expo-linear-gradient , expo-linking , expo-local-build-cache-provider , expo-manifests , expo-mesh-gradient , expo-metro-config , expo-module-scripts , expo-modules-core , expo-modules-jsi , expo-modules-test-core , expo-navigation-bar , expo-network , expo-network-addons , expo-prebuild-config , expo-print , expo-router , expo-router-server , expo-screen-capture , expo-sharing , expo-splash-screen , expo-sqlite , expo-standard-web-crypto , expo-status-bar , expo-symbols , expo-task-manager , expo-template-bare-minimum , expo-template-blank , expo-template-blank-typescript , expo-template-default , expo-template-tabs , expo-vector-icons , expo-web-browser , expo-widgets , graphql-language-service-server , icss-utils , ipx , isomorphic-dompurify , jest-expo , jsdom , module-federation/vite , netlify-aws-lambda-compat , netlify-build , netlify-dev , netlify-edge-bundler , netlify-functions-dev , netlify-functions-utils , netlify-images , netlify-nuxt , netlify-vite-plugin , netlify-vite-plugin-tanstack-start , netlify-zip-it-and-ship-it , oxc-unshadowed-visitor , postcss , postcss-attribute-case-insensitive , postcss-calc , postcss-charset , postcss-clamp , postcss-color-functional-notation , postcss-color-hex-alpha , postcss-color-rebeccapurple , postcss-colormin , postcss-convert-values , postcss-custom-media , postcss-custom-selectors , postcss-dir-pseudo-class , postcss-discard-comments , postcss-discard-duplicates , postcss-discard-empty , postcss-discard-overridden , postcss-discard-unused , postcss-focus-visible , postcss-focus-within , postcss-font-variant , postcss-gap-properties , postcss-image-set-function , postcss-loader , postcss-logical , postcss-merge-idents , postcss-merge-longhand , postcss-merge-rules , postcss-minify-font-values , postcss-minify-gradients , postcss-minify-params , postcss-minify-selectors , postcss-modules , postcss-modules-extract-imports , postcss-modules-local-by-default , postcss-modules-scope , postcss-modules-values , postcss-nesting , postcss-normalize-display-values , postcss-normalize-positions , postcss-normalize-repeat-style , postcss-normalize-string , postcss-normalize-timing-functions , postcss-normalize-unicode , postcss-normalize-url , postcss-normalize-whitespace , postcss-opacity-percentage , postcss-ordered-values , postcss-overflow-shorthand , postcss-page-break , postcss-place , postcss-plugins , postcss-pseudo-class-any-link , postcss-reduce-idents , postcss-reduce-initial , postcss-replace-overflow-wrap , postcss-selector-not , postcss-sort-media-queries , postcss-svgo , postcss-unique-selectors , postcss-values-parser , postcss-zindex , precinct , primitives , runtime-cli , rushstack-heft-sass-plugin , rushstack-heft-web-rig , sanity-blueprints , sanity-cli , sanity-cli-build , sanity-io/cli , sanity-workbench-cli , sass-loader , source-map-js , source-map-loader , stylehacks , svgo , vite , vite-node

Affected packages:

source-map-js @ 1.2.1 (+713 more)