CVE-2026-93749 source-map-js: Event-loop DoS via unvalidated indexed source-map section offsets (1.2.1 -> 1.2.2) - #1168

Bumps source-map-js from 1.2.1 to 1.2.2 in openam-ui/openam-ui-js-sdk (package-lock.json only), clearing Dependabot alert #363. openam-ui-js-sdk is the only lock file in the repository that resolves source-map-js.

Advisory

CVE-2026-93749 / GHSA-68fv-2mgg-jv7q (fixed in 1.2.2) — Improper validation of specified index, position, or offset in input (CWE-1284). An indexed source map ({ "sections": [...] }) carries a per-section offset.line that was never validated. Fed through SourceNode.fromStringWithSourceMap, it drives a line-padding loop that pushes one newline per line up to that offset, so a tiny map with a huge offset.line blocks the event loop for an attacker-chosen time, and 1e999 (which JSON.parse yields as Infinity) ends in RangeError: Invalid array length. The fix (7rulnik/source-map-js#79) closes four amplification paths reachable from untrusted map input:

• section offsets must be non-negative safe integers, and offset.line is capped at 10,000,000 including the summed offsets of nested sections;
• the IndexedSourceMapConsumer sources getter, which was exponential in nesting depth, reads each section once;
• _serializeMappings builds large ; gaps as one flat string instead of a rope that could exhaust the heap;
• fromStringWithSourceMap stops padding once the generated code is exhausted.

Availability-only: no code execution, no data exposure.

Impact on OpenAM

None at runtime, none in practice in the build. source-map-js is a transitive development dependency of openam-ui-js-sdk (dev: true), pulled in by postcss 8.5.23 (under vite 8.0.16), sass 1.93.2 and css-tree 3.1.0 (under jsdom via cssstyle and @asamuzakjp/dom-selector). No OpenAM source imports it, and it does not end up in the SDK bundle (target/lib, target/app) or the WAR — the runtime dependencies are only react, react-dom and react-router.

The Maven build reaches these tools through npm run build (Vite, which compiles src/index.scss through Sass) and npm run test:run (Vitest with jsdom). What they read is the repository's own source — src/index.scss has no @import / @use — and the packages pinned in the lock file, never a source map from outside, so the attacker-supplied indexed source map the advisory requires does not exist here. The bump takes the development toolchain out of the vulnerable range.

Change

The node_modules/source-map-js entry in openam-ui/openam-ui-js-sdk/package-lock.json: 1.2.1 → 1.2.2 (version, resolved, integrity). package.json is untouched — postcss asks for ^1.2.1, css-tree for ^1.0.1 and sass for >=0.6.2 <2.0.0, all satisfied by 1.2.2. No code change; 1.2.2 additionally stops crashing in browsers whose CSP script-src forbids unsafe-eval (7rulnik/source-map-js#29), which does not apply to a build-time dependency.

Verified:

• the lock file integrity matches npm view [email protected] dist.integrity
• node_modules/source-map-js is the only source-map-js entry in this lock file

References

• GHSA-68fv-2mgg-jv7q
• https://nvd.nist.gov/vuln/detail/CVE-2026-93749
• Security Advisory: Event-loop denial of service in SourceNode via unvalidated section offset line 7rulnik/source-map-js#76
• Fix denial of service from malicious indexed source maps (CVE-2026-93749) 7rulnik/source-map-js#79
• https://github.com/7rulnik/source-map-js/releases/tag/v1.2.2