HighFix available
node-postcss — security advisory
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.
- Products
- node-postcss
- Affected versions
- 8.4.20+~cs8.0.23-1, 8.4.20+~cs8.0.23-1+deb12u1, 8.4.31+~cs8.0.26-1, 8.4.39+~cs9.2.29-1, 8.4.49+~cs9.2.32-1, 8.5.12+~cs9.3.32-1, 8.5.14+~cs9.3.34-1, 8.5.15+~cs9.3.34-1, 8.5.15+~cs9.3.38-1, 8.5.15+~cs9.3.39-1, 8.5.19+~cs10.2.23-1, 8.5.21+~cs10.2.23-1, 8.5.23+~cs10.2.23-1, 8.5.25+~cs10.2.23-1, 8.5.26+~cs10.2.24-1, 8.5.28+~cs10.2.24-1, 8.5.31+~cs10.2.26-1, 8.5.6+~cs9.3.28-1, 8.5.8+~cs9.3.30-1, 8.5.9+~cs9.3.30-1
- Fixed versions
- 8.5.31+~cs10.2.26-1
- CVEs
- CVE-2026-93749
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 21:55 UTC · Revision 1
Source evidence
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.
osv:DEBIAN-CVE-2026-93749
node-postcss
Fixed versions: Not specified
node-postcss
Fixed versions: Not specified
node-postcss
Fixed versions: 8.5.31+~cs10.2.26-1
Complete source record
{
"id": "d1d8301bb97de6a66202dbbe5851d0ad0f3410a74eef823904df67e4622e4153",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-93749",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-93749",
"summary": "source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.",
"evidence": "osv:DEBIAN-CVE-2026-93749",
"products": [
{
"name": {
"value": "node-postcss",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "8.4.20+~cs8.0.23-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.4.20+~cs8.0.23-1+deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "8.4.31+~cs8.0.26-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.4.39+~cs9.2.29-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.4.49+~cs9.2.32-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.12+~cs9.3.32-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.14+~cs9.3.34-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.15+~cs9.3.34-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.15+~cs9.3.38-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.15+~cs9.3.39-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.19+~cs10.2.23-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.21+~cs10.2.23-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.23+~cs10.2.23-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.25+~cs10.2.23-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.26+~cs10.2.24-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.28+~cs10.2.24-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.31+~cs10.2.26-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.6+~cs9.3.28-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.8+~cs9.3.30-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.5.9+~cs9.3.30-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "node-postcss",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "8.4.49+~cs9.2.32-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.5.12+~cs9.3.32-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.5.14+~cs9.3.34-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.5.15+~cs9.3.34-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.5.15+~cs9.3.38-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.5.15+~cs9.3.39-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.5.19+~cs10.2.23-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.5.21+~cs10.2.23-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.5.23+~cs10.2.23-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.5.25+~cs10.2.23-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.5.26+~cs10.2.24-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.5.28+~cs10.2.24-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.5.31+~cs10.2.26-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.5.6+~cs9.3.28-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.5.8+~cs9.3.30-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.5.9+~cs9.3.30-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "node-postcss",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.5.31+~cs10.2.26-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "8.4.49+~cs9.2.32-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.5.12+~cs9.3.32-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.5.14+~cs9.3.34-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.5.15+~cs9.3.34-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.5.15+~cs9.3.38-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.5.15+~cs9.3.39-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.5.19+~cs10.2.23-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.5.21+~cs10.2.23-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.5.23+~cs10.2.23-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.5.25+~cs10.2.23-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.5.26+~cs10.2.24-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.5.28+~cs10.2.24-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.5.6+~cs9.3.28-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.5.8+~cs9.3.30-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.5.9+~cs9.3.30-1",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2026-93749",
"aliases": [
"DEBIAN-CVE-2026-93749"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-postcss",
"purl": "pkg:deb/debian/node-postcss?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"8.4.20+~cs8.0.23-1",
"8.4.20+~cs8.0.23-1+deb12u1",
"8.4.31+~cs8.0.26-1",
"8.4.39+~cs9.2.29-1",
"8.4.49+~cs9.2.32-1",
"8.5.12+~cs9.3.32-1",
"8.5.14+~cs9.3.34-1",
"8.5.15+~cs9.3.34-1",
"8.5.15+~cs9.3.38-1",
"8.5.15+~cs9.3.39-1",
"8.5.19+~cs10.2.23-1",
"8.5.21+~cs10.2.23-1",
"8.5.23+~cs10.2.23-1",
"8.5.25+~cs10.2.23-1",
"8.5.26+~cs10.2.24-1",
"8.5.28+~cs10.2.24-1",
"8.5.31+~cs10.2.26-1",
"8.5.6+~cs9.3.28-1",
"8.5.8+~cs9.3.30-1",
"8.5.9+~cs9.3.30-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93749.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-postcss",
"purl": "pkg:deb/debian/node-postcss?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"8.4.49+~cs9.2.32-1",
"8.5.12+~cs9.3.32-1",
"8.5.14+~cs9.3.34-1",
"8.5.15+~cs9.3.34-1",
"8.5.15+~cs9.3.38-1",
"8.5.15+~cs9.3.39-1",
"8.5.19+~cs10.2.23-1",
"8.5.21+~cs10.2.23-1",
"8.5.23+~cs10.2.23-1",
"8.5.25+~cs10.2.23-1",
"8.5.26+~cs10.2.24-1",
"8.5.28+~cs10.2.24-1",
"8.5.31+~cs10.2.26-1",
"8.5.6+~cs9.3.28-1",
"8.5.8+~cs9.3.30-1",
"8.5.9+~cs9.3.30-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93749.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.5.31+~cs10.2.26-1"
}
]
}
],
"package": {
"name": "node-postcss",
"purl": "pkg:deb/debian/node-postcss?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"8.4.49+~cs9.2.32-1",
"8.5.12+~cs9.3.32-1",
"8.5.14+~cs9.3.34-1",
"8.5.15+~cs9.3.34-1",
"8.5.15+~cs9.3.38-1",
"8.5.15+~cs9.3.39-1",
"8.5.19+~cs10.2.23-1",
"8.5.21+~cs10.2.23-1",
"8.5.23+~cs10.2.23-1",
"8.5.25+~cs10.2.23-1",
"8.5.26+~cs10.2.24-1",
"8.5.28+~cs10.2.24-1",
"8.5.6+~cs9.3.28-1",
"8.5.8+~cs9.3.30-1",
"8.5.9+~cs9.3.30-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93749.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T16:02:23.079870709Z",
"provider": "osv",
"upstream": [
"CVE-2026-93749"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-93749"
]
},
"related_cves": [
{
"value": "CVE-2026-93749",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 414899,
"published_at": "2026-09-18T18:18:33.48+00:00"
}