Description
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
7rulnik source-map-js
Default version status: unaffected
0 to ≤ 1.2.1affected
pkg:npm/source-map-jsReferences
- https://github.com/7rulnik/source-map-js/issues/76 ↗
- https://github.com/7rulnik/source-map-js ↗
- https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118 ↗
- https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service ↗