CVE-2026-93749: source-map-js 1.2.1 Indexed Source Map DoS

A source map parser sitting under every CSS build

source-map-js is the library PostCSS and Tailwind's Node integration use to read source maps. In this project it was pinned at 1.2.1 by the pnpm lockfile, and CVE-2026-93749 affects that version.

The advisory is short: Denial of Service via malformed indexed source maps. A well-formed map makes SourceMapConsumer behave normally. When the map is an indexed map (one whose top level is a sections array of sub-maps rather than a flat mappings string) and that map is malformed, the parse can exhaust the process.

This matters because the dependency never appears in your own code. Nobody on the team wrote require('source-map-js'). It runs whenever PostCSS picks up an upstream map, for example from an inline /*# sourceMappingURL=data:application/json;base64,... */ comment at the bottom of a CSS file. If that map is hostile, your build is the thing that stops.

Affected Versions

Check whether you are on the vulnerable version with pnpm why source-map-js. If it reports 1.2.1 under postcss or @tailwindcss/node, you are exposed in the same way this project was.

The Vulnerability Explained

Where 1.2.1 entered the tree

The lockfile shows two packages pulling in the vulnerable version. The first is PostCSS, recognizable by its sibling dependencies:

    dependencies:
      nanoid: 3.3.18
      picocolors: 1.1.1
      source-map-js: 1.2.1

The second is @tailwindcss/node, which lists it next to lightningcss, magic-string, and tailwindcss 4.3.3. Both dependents allowed a version range that 1.2.1 satisfied, so pnpm de-duplicated them onto a single copy:

  source-map-js@1.2.1: {}

What an "indexed" source map is

Most source maps are flat, with one mappings string. The spec also allows an index map, which stitches several maps together at given offsets:

{
  "version": 3,
  "sections": [
    { "offset": { "line": 0, "column": 0 }, "map": { "version": 3, "mappings": "AAAA", "sources": ["a.css"], "names": [] } }
  ]
}

When new SourceMapConsumer(raw) sees a sections key, it switches to the indexed-consumer code path. That path walks each section, validates its offset, and builds a nested consumer for each map.

CVE-2026-93749 lives on that path. The advisory says malformed input there leads to denial of service. It does not publish which field triggers the problem, so this post does not guess at a specific payload. In practice, a structurally invalid sections array is enough to tie up or kill the Node process that is parsing it.

Attack scenario against this toolchain

1. An attacker publishes, or compromises, a package that ships a CSS file. They append an inline sourceMappingURL data URI containing a malformed indexed map.
2. The project imports that CSS. During vite build, a dev-server HMR cycle, or a Tailwind compile, PostCSS's previous-map handling decodes the annotation and passes it to SourceMapConsumer.
3. source-map-js 1.2.1 enters the indexed-map path. The process then hangs or crashes.

The real-world impact is availability:

• CI jobs time out.
• Preview deployments fail.
• Local dev servers become unresponsive.

A worse case exists if any server-side code compiles user-supplied CSS on request, for example a theme editor or an email template builder. There, each request can take down a worker.

The original PR is candid that reachability was not verified. That is a fair caveat. The parser is still on the hot path of every CSS compile, so "reachable" is the safer assumption.

The Fix

The change has two parts, and each one is needed.

1. A pnpm override in the package manifest. Neither PostCSS nor @tailwindcss/node has to release anything. The override is added inside the pnpm configuration object:

    "overrides": {
      "source-map-js": "1.2.2"
    }

This forces every transitive request for source-map-js to resolve to 1.2.2, whatever range the dependent declares. Without it, a future pnpm install could re-resolve to 1.2.1 if a dependent's range still allowed it.

2. The regenerated lockfile. pnpm records the override at the top of the lockfile so that every install honors it:

overrides:
  source-map-js: 1.2.2

It also rewrites both snapshot entries:

-      source-map-js: 1.2.1
+      source-map-js: 1.2.2

The package entry moves from source-map-js@1.2.1 to source-map-js@1.2.2 with a new integrity value. The engines: {node: '>=0.10.0'} constraint is unchanged.

Together, these changes mean the SourceMapConsumer that PostCSS and Tailwind call is the patched build. A malformed sections array no longer takes the process down.

Key Takeaways

• Transitive source-map parsers run on untrusted input. PostCSS reads inline sourceMappingURL data URIs from any CSS it processes, including CSS that ships inside third-party packages.
• Indexed maps are a separate parsing path. A sections array routes into different consumer logic than a flat mappings string, and CVE-2026-93749 is specific to that path.
• Use pnpm.overrides when the vulnerable package is two levels deep. Both postcss and @tailwindcss/node depended on source-map-js, and one override fixed both without waiting on either maintainer.
• Commit the lockfile's overrides: block together with the manifest change. The lockfile entry is what makes the 1.2.2 pin take effect in CI.
• Patch-level bumps still deserve a build run. No automated check ran on this PR, so run one CSS build to confirm 1.2.2 behaves the same for your maps.

How Orbis AppSec Detected This

• Source: source map JSON handed to the library. That includes inline sourceMappingURL annotations in CSS, which PostCSS decodes, and maps passed via the PostCSS map.prev option or through @tailwindcss/node.
• Sink: the source-map-js SourceMapConsumer constructor, on its indexed-map (sections) parsing path, in version 1.2.1.
• Missing control: version 1.2.1 does not safely handle malformed indexed maps. The project also had no override preventing that version from resolving transitively.
• CWE: unknown (none assigned for CVE-2026-93749).
• Fix: a pnpm overrides entry pins source-map-js to 1.2.2, and the lockfile was regenerated so PostCSS and @tailwindcss/node both resolve the patched release.

The finding came from a Trivy dependency scan that matched source-map-js@1.2.1 in the pnpm lockfile against CVE-2026-93749 (NVD entry).

Orbis AppSec detected this vulnerability automatically. Try Orbis AppSec on your repositories to find and fix issues like this.

Conclusion

CVE-2026-93749 sits in the indexed-source-map path of source-map-js 1.2.1. That code runs implicitly whenever PostCSS or Tailwind's Node integration reads an upstream map.

A malformed sections array arriving in a CSS file's inline annotation can hang or crash the build. The same applies to any server that compiles CSS on request.

The fix needed no code change and no upstream release. One pnpm.overrides entry and a regenerated lockfile move both consumers to source-map-js 1.2.2. If your project uses PostCSS or Tailwind v4 with pnpm, run pnpm why source-map-js today.