CVE-2026-93749

🗓️ 18 Sep 2026 18:18:00Reported by ubuntu.comType

ubuntucve🔗 ubuntu.com👁 19 Views

source-map-js through 1.2.1 DoS via unvalidated offset line value in indexed source maps.

Reporter	Title	Published	Views	Family All 252
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026	30 Oct 202612:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Remediator is affected by mutiple vulnerabilities	26 Oct 202605:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in source-map-js (CVE-2026-93749)	27 Oct 202606:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Cluster Performance Insights uses axios-1.18.1, source-map-js-1.2.1, qs-6.16.0, pymongo-4.17.0, moment-2.30.1, pymongo-4.18.1 and ansible-14.4.0 which are vulnerable to multiple CVE	30 Oct 202606:22	–	ibm
IBM Security Bulletins	Security Bulletin: The Hub App for IBM QRadar SIEM contains components with known vulnerabilities	27 Oct 202600:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM ApplinX is vulnerable to Improper Validation of Specified Quanitity in Input issue due to the use of source-map-js and @angular/router (CVE-2026-93749).	21 Oct 202612:42	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Integration are vulnerable to a vulnerability in source-map-js	28 Oct 202615:31	–	ibm
IBM Security Bulletins	Security Bulletin: The Use Case Manager App for IBM QRadar SIEM contains components with known vulnerabilities	19 Oct 202618:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Rational Developer for i is affected by Multiple vulnerabilities	28 Oct 202615:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Log Management AQL Plugin contains components with known vulnerabilities	16 Oct 202621:14	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Ubuntu	20.04	all	node-postcss	0	node-postcss_0_all.deb
Ubuntu	22.04	all	node-postcss	0	node-postcss_0_all.deb
Ubuntu	24.04	all	node-postcss	0	node-postcss_0_all.deb
Ubuntu	26.04	all	node-postcss	0	node-postcss_0_all.deb

Source	Link
cve	www.cve.org/CVERecord
github	www.github.com/7rulnik/source-map-js/issues/76
github	www.github.com/7rulnik/source-map-js
github	www.github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js
vulncheck	www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service

24 Sep 2026 01:35Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.17.5

CVSS 48.7

EPSS0.00455

SSVC

source-map-js DoS offset line value event loop blocking unix