source-map-js through 1.2.1 Event Loop Denial of Service
CVE-2026-93749 is fixed in 4 products on 1 platform, first by DEBIAN-CVE-2026-93749, released September 18, 2026. It is not reported as exploited. Patch Radar priority: High.
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| firefox · amzn 2023 | 140.17.0-1.amzn2023.0.1 | ALAS2023-2026-3214 | Nov 7, 2026 |
| firefox-debuginfo · amzn 2023 | 140.17.0-1.amzn2023.0.1 | ALAS2023-2026-3214 | Nov 7, 2026 |
| firefox-debugsource · amzn 2023 | 140.17.0-1.amzn2023.0.1 | ALAS2023-2026-3214 | Nov 7, 2026 |
| node-postcss · Debian 14 | 8.5.31+~cs10.2.26-1 | DEBIAN-CVE-2026-93749 | Sep 18, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.