Source Map Js
Monthly
Denial of service in source-map-js up to and including 1.2.1 allows an attacker who can supply an indexed source map to hang the Node.js process: the library reads the per-section offset.line value without bounds checking, so an arbitrarily large integer forces a long synchronous loop that blocks the event loop and starves all other requests. The flaw (CWE-1284, improper validation of a specified quantity) is reachable only where a service actually parses attacker-controlled maps - for example an online transpiler, upload-accepting bundler service, or error/stack-trace resolver - since source maps are normally trusted build-time artifacts; the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects that data-flow prerequisite, and no public exploit was identified at time of analysis. Impact is availability only; despite the 'Information Disclosure' tag in some feeds, there is no confidentiality or integrity loss in the assessed vector.
Denial of service in source-map-js up to and including 1.2.1 allows an attacker who can supply an indexed source map to hang the Node.js process: the library reads the per-section offset.line value without bounds checking, so an arbitrarily large integer forces a long synchronous loop that blocks the event loop and starves all other requests. The flaw (CWE-1284, improper validation of a specified quantity) is reachable only where a service actually parses attacker-controlled maps - for example an online transpiler, upload-accepting bundler service, or error/stack-trace resolver - since source maps are normally trusted build-time artifacts; the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects that data-flow prerequisite, and no public exploit was identified at time of analysis. Impact is availability only; despite the 'Information Disclosure' tag in some feeds, there is no confidentiality or integrity loss in the assessed vector.