More information

\n\n#### Details\nsource-map-js through 1.2.1 fails to validate the per-section offset\nline value in indexed source maps, allowing attackers to specify\narbitrary numeric values. Attackers can supply extremely large offset\nline values that cause synchronous event loop blocking for extended\nperiods, preventing the service from handling other requests.\n\n#### Severity\n- CVSS Score: 8.7 / 10 (High)\n- Vector String:\n`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`\n\n#### References\n-\n[https://nvd.nist.gov/vuln/detail/CVE-2026-93749](https://nvd.nist.gov/vuln/detail/CVE-2026-93749)\n-\n[https://github.com/7rulnik/source-map-js/issues/76](https://redirect.github.com/7rulnik/source-map-js/issues/76)\n-\n[https://github.com/7rulnik/source-map-js](https://redirect.github.com/7rulnik/source-map-js)\n-\n[https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118](https://redirect.github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118)\n-\n[https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service](https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service)\n-\n[https://github.com/7rulnik/source-map-js/pull/79](https://redirect.github.com/7rulnik/source-map-js/pull/79)\n-\n[https://github.com/7rulnik/source-map-js/commit/cf7658058ceeaa8619d5ae0ec90be6905209d016](https://redirect.github.com/7rulnik/source-map-js/commit/cf7658058ceeaa8619d5ae0ec90be6905209d016)\n-\n[https://github.com/7rulnik/source-map-js/releases/tag/v1.2.2](https://redirect.github.com/7rulnik/source-map-js/releases/tag/v1.2.2)\n-\n[https://github.com/advisories/GHSA-68fv-2mgg-jv7q](https://redirect.github.com/advisories/GHSA-68fv-2mgg-jv7q)\n\nThis data is provided by the [GitHub Advisory\nDatabase](https://redirect.github.com/advisories/GHSA-68fv-2mgg-jv7q)\n([CC-BY\n4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n

\n\n---\n\n### Release Notes\n\n

7rulnik/source-map-js (source-map-js)

\n\n###\n[`v1.2.2`](https://redirect.github.com/7rulnik/source-map-js/blob/HEAD/CHANGELOG.md#122)\n\n[Compare\nSource](https://redirect.github.com/7rulnik/source-map-js/compare/v1.2.1...v1.2.2)\n\n- Fix crash when executing in browser with CSP script-src that don't\npermit unsafe-eval\n([#29](https://redirect.github.com/7rulnik/source-map-js/pull/29))\n[@xfournet](https://redirect.github.com/xfournet)\n\n- Fix denial of service from malicious indexed source maps\n(CVE-2026-93749)\n([#79](https://redirect.github.com/7rulnik/source-map-js/pull/79))\n\nReported by [@waydeshi](https://redirect.github.com/waydeshi) in\n[#76](https://redirect.github.com/7rulnik/source-map-js/issues/76).\nA fix was also proposed by\n[@aniebiet](https://redirect.github.com/aniebiet) in\n[#78](https://redirect.github.com/7rulnik/source-map-js/pull/78).\n\n

\n\n---\n\n### Configuration\n\n📅 **Schedule**: (in timezone Europe/Paris)\n\n- Branch creation\n - At any time (no schedule defined)\n- Automerge\n - At any time (no schedule defined)\n\n🚦 **Automerge**: Enabled.\n\n♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the\nrebase/retry checkbox.\n\n🔕 **Ignore**: Close this PR and you won't be reminded about this update\nagain.\n\n---\n\n- [ ] If you want to rebase/retry this PR, check\nthis box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).\nView the [repository job\nlog](https://developer.mend.io/github/AmadeusITGroup/otter).\n\n","headSha","0252305d7569fdb50acab3f07985e3c3593d2d03","baseSha","parentShas","commitLink","https://github.com/AmadeusITGroup/otter/commit/0252305d7569fdb50acab3f07985e3c3593d2d03","author","Salomé Do","authorEmail","117105135+sdo-1A@users.noreply.github.com","authorUrl","https://github.com/github-merge-queue[bot]","authorAvatarUrl","https://github.com/github-merge-queue[bot].png","repositoryUrl","https://github.com/AmadeusITGroup/otter","platformName","GITHUB_ACTIONS","runnerProvider","GITHUB","isFork","isDraft",{"_146":147,"_28":148,"_76":149,"_78":150,"_151":152,"_153":154,"_155":-5,"_156":21,"_157":-5,"_158":-5,"_159":-5,"_160":161,"_162":21,"_163":164,"_165":16,"_166":399,"_168":169,"_170":171,"_172":-5,"_173":174,"_175":400,"_177":178,"_179":-5,"_180":16,"_181":182,"_183":184},[],{},"orgId",["D",1676055838344],"@o3r/framework","type","PRIMARY","publicCloudCounterpartId","privateCloudCounterpartId","installationSource","user","remoteSourceIntegrationType","GITHUB_EVENTLESS","featureMarkers",{"_445":21,"_446":16,"_447":21},"manualSetAccessLevel","idAccessLevel","READ_ONLY","patAccessLevel",{"_438":395,"_439":440,"_441":442,"_443":444},"flakyTaskConfiguration",{"_434":435,"_436":437},"aiTaskFixingConfiguration",{"_82":21,"_289":21,"_290":21,"_291":16,"_292":21,"_293":430,"_296":-5,"_297":431,"_299":432,"_301":433},"enableWorkspaceDataCaching","showVcsStatusChecks","defaultBranch","visibility","ALLOW_UNAUTHENTICATED","sandboxingConfiguration","launchTemplate",[],[],[],[],"threshold","NORMAL","samplePeriodDays",28,"provider","repositoryFullName","AmadeusITGroup/otter","repositoryId","589619867","repositoryVisibility","PUBLIC","isRemoteCachingActive","isDistributedTaskExecutionActive","isVCSIntegrationActive","currentUser","currentHostname","cloud.nx.app","incident",["P",452],"notifications",["P",454],"isSystemAdmin","isSingleTenant","isPATExpiryAfterLoginEnabled","isOrganizationAccessEnabled","isExecutiveReportDisabled","loginas","repositoryAccessProvidersToOffer",[],"redirectTo","/cipes/6acce4746c9e373a6d64d504/timeline?runGroup=38257418548-1","deferredUserOrganizations",["P",466],"sidebarCollapsed","toast","currentUserId","currentUserEmail","signedInUser","isImpersonating","isBotRequest","ENV",{"_539":21,"_53":16,"_540":21,"_541":21,"_542":21,"_543":544,"_545":546,"_547":16,"_548":549,"_550":551,"_479":552},"posthogBootstrap",{"_509":510,"_511":512},"ultracacheUiEnabled","pylon",{"_501":502,"_503":504,"_74":505,"_506":-7,"_507":508},"requestInfo",{"_483":484,"_485":52,"_486":487,"_488":489,"_490":491},"hints",{"_494":497,"_499":500},"origin","path","/cipes/6acce4746c9e373a6d64d504/timeline","url","https://cloud.nx.app/cipes/6acce4746c9e373a6d64d504/timeline","userPreferences",{"_492":493},"theme",{"_74":182,"_494":495,"_496":497,"_498":497},"variant","system","resolvedVariant","light","clientColorScheme","timeZone","UTC","appId","a1074fe2-8172-4ebd-9889-879f8308a0a2","email","0ef37f9a-68df-4627-83c6-607e842fe1d5@nxcloud.invalid","Anonymous Nx Cloud Visitor","avatarUrl","emailHash","3abbb91dd5d81f7d6fbf20cf1d9624dfed01155a81d1714f1921232dbd147e0b","distinctID","0ef37f9a-68df-4627-83c6-607e842fe1d5","featureFlags",{"_513":21,"_514":515,"_516":21,"_517":21,"_518":21,"_519":21,"_520":21,"_521":16,"_522":21,"_523":524,"_525":21,"_526":21,"_527":16,"_528":529,"_530":16,"_531":21,"_532":21,"_533":21,"_534":21,"_535":21,"_536":82,"_537":82,"_538":16},"workspace_badges","one_page_connect_workspace_manual","test","config_yaml","demo-mode","workspace_sandboxing_toggle","resource_usage_toggle","teams_minimum_spend","cipe_execution_timeline","automated_add_ons","cnw_empty_workspace_position","treatment","resource_addon_default","workspace_rewind","new_layout","welcome_view_cnw_experiment","variant-2","feature_activation_guide","pylon_chat","non_dte_resource_usage","show_setup_self_healing_ci_alert","new_access_control","survey-targeting-8e88152ae4-custom","one_page_connect_workspace_gitlab","one_page_connect_workspace_github","run_details_polling","isProduction","isAnalyticsEnabled","isPosthogEnabled","isPylonEnabled","privateCloud",{"_571":562,"_51":52},"auth0",{"_565":566,"_567":568,"_569":570},"e2eTestMode","rollbar",{"_557":558,"_559":560,"_82":21,"_561":562,"_563":21,"_564":21},"posthog",{"_553":554,"_555":556},{"_501":502},"apiKey","phc_eTmACxF0EKeNRjAZbfpdszbHYumyKhWqsIpMU4Wi53c","apiHost","https://pha-prx.ops.cloud.nx.app","accessToken","d0e4070ed1d54ed29429808f497ffbab3e77f1c74c2a9427fa5c5e418eea62ca96294bc716a7e8210acf93f0d37b6d29","environment","production","codeVersion","2610.14.0002","captureUncaught","captureUnhandledRejections","domain","auth.nx.app","clientId","Ron6k221B4IaH0QK9hmHuCneTovLLPpX","audience","https://api.nrwl.io/","containerVersionTimestamp"]