Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2026-93749 in source-map-js stems from insufficient validation and inefficient processing of offset.line values in indexed source maps, leading to event-loop denial of service. Attackers can craft malicious source maps with extremely large offset.line values, which, when processed by the vulnerable functions, cause excessive resource consumption (CPU and memory) and block the Node.js event loop.
My analysis focused on the commit cf7658058ceeaa8619d5ae0ec90be6905209d016, which explicitly addresses this CVE. By examining the patch, I identified four key areas of vulnerability:
IndexedSourceMapConsumer constructor: This function failed to validate the offset.line and offset.column values. The fix introduces isValidOffset and MAX_SECTION_OFFSET_LINE checks to prevent arbitrary large values from being accepted, which previously led to excessive memory allocation and processing.IndexedSourceMapConsumer.prototype.sources getter: This getter exhibited exponential time complexity when dealing with deeply nested indexed maps. The original code repeatedly accessed the sources getter of nested consumers, causing a performance bottleneck. The patch optimizes this by caching the sectionSources once per section, transforming the complexity from exponential to linear.SourceMapGenerator.prototype._serializeMappings: This function was inefficient in handling large gaps in generatedLine values during serialization. The original implementation used a loop to append semicolons one by one, which created a large number of string objects and could exhaust heap memory. The patch replaces this with String.prototype.repeat(), a more efficient method for generating long strings.SourceNode.fromStringWithSourceMap: This function was susceptible to a DoS when processing source maps with offset.line values far exceeding the actual code length. The original code would attempt to generate a vast number of empty lines, blocking the event loop. The patch adds a check to break this loop early if the generated code is exhausted, preventing the creation of unnecessary lines.In summary, the vulnerability is rooted in a combination of missing input validation and inefficient algorithms that did not account for maliciously crafted or extremely large input values in source map offsets. The identified functions are critical in parsing, generating, and consuming source map data, making them direct points of exploitation for event-loop denial of service.
IndexedSourceMapConsumerlib/source-map-consumer.js
IndexedSourceMapConsumer.prototype.sourceslib/source-map-consumer.js
SourceMapGenerator.prototype._serializeMappingslib/source-map-generator.js
SourceNode.fromStringWithSourceMaplib/source-node.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| source-map-js | npm | >= 1.0.0, < 1.2.2 | 1.2.2 |