CVE-2026-93749Disclosure

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-1284

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-09-21); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets1 URL

By indicator

https://www.valtersit.com/cve/CVE-2026-93749/

Full discourse2 posts

Upwind Security MDR@UpwindMDR46d
Disclosure
🚨HIGH - source-map-js Indexed Source Map Offset Line DoS (CVE-2026-93749) source-map-js fails to validate the per-section offset line value in indexed source maps. Supplying extremely large numeric offset.line values forces long synchronous processing that blocks the Node.js event loop, causing a denial of service. Non-indexed source maps aren’t affected. 👉Affected: source-map-js <= 1.2.1
Post summary
The tweet discloses a newly identified Denial‑of‑Service vulnerability in source-map-js (CVE‑2026‑93749) caused by unvalidated large offset.line values that can block the Node.js event loop, affecting versions ≤1 2.1, without mentioning proof‑of‑concept code, exploits, or a patch.
0001076
310 followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters47d
Disclosure
CVE-2026-93749: source-map-js thru 1.2.1 fails to validate section offset line values in indexed source maps. Crafted input blocks the event loop, causing DoS. CVSS 7.5. No patch yet. Update immediately or restrict https://www.valtersit.com/cve/CVE-2026-93749/ #CVE #infosec #cybersecurity #sourcemapjs #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The text announces CVE-2026-93749, providing technical details (DoS via unvalidated source map offsets, CVSS 7.5), but no patch, exploitation claims, or PoC are mentioned.
0000042
1.1K followersView on X

Explore more

Back to dashboard