DEBIAN-CVE-2026-93749
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-93749
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93749.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-93749
- Upstream
- Published
- 2026-09-18T18:18:33Z
- Modified
- 2026-09-19T05:00:34Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.
- References
Affected packages
Debian:12 / node-postcss
Package
- Name
- node-postcss
- Purl
- pkg:deb/debian/node-postcss?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
8.*
8.4.20+~cs8.0.23-1
8.4.20+~cs8.0.23-1+deb12u1
8.4.31+~cs8.0.26-1
8.4.39+~cs9.2.29-1
8.4.49+~cs9.2.32-1
8.5.6+~cs9.3.28-1
8.5.8+~cs9.3.30-1
8.5.9+~cs9.3.30-1
8.5.12+~cs9.3.32-1
8.5.14+~cs9.3.34-1
8.5.15+~cs9.3.34-1
8.5.15+~cs9.3.38-1
8.5.15+~cs9.3.39-1
8.5.19+~cs10.2.23-1
8.5.21+~cs10.2.23-1
8.5.23+~cs10.2.23-1
8.5.25+~cs10.2.23-1
8.5.26+~cs10.2.24-1
Debian:13 / node-postcss
Package
- Name
- node-postcss
- Purl
- pkg:deb/debian/node-postcss?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:14 / node-postcss
Package
- Name
- node-postcss
- Purl
- pkg:deb/debian/node-postcss?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected