Affected: CleanStart: langfuse-worker

Security vulnerability affects the langfuse-worker package. source-map-js through 1.

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

Affected: npm: source-map-js

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

curl: libcurl: Unauthorized connection reuse due to a logical error curl: curl: Cookie injection via malicious HTTP server using super cookies curl: curl: Information disclosure via incorrect .netrc password lookup libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials curl: curl: Information disclosure via incorrect Digest authentication header reuse perl: Perl: Incorrect regular expression processing via large regular expressions gdb: gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server libarchive: heap overflow OOB read while parsing a tar archive contains a PAX extended header xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c openssl: QUIC server may trigger double free when processing INITIAL packet xz: XZ Utils: Denial of Service via buffer overflow in index decoding gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c gawk: gawk: Memory corruption via integer overflow gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service nginx: NGINX: Arbitrary code execution via crafted HTTP requests sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion expat: libexpat: Use-after-free vulnerability due to improper hand…

Affected: Ubuntu:20.04:LTS: node-postcss, Ubuntu:22.04:LTS: node-postcss, Ubuntu:24.04:LTS: node-postcss, Ubuntu:26.04:LTS: node-postcss

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.