MapLibre: geojson-vt stack exhaustion denial-of-service (CVE-2026-58505)
The @maplibre/geojson-vt library is vulnerable to an uncontrolled recursion flaw during the processing of nested GeometryCollection objects, allowing a remote unauthenticated attacker to trigger a stack overflow and denial-of-service.
CVE search metadata
CVE search record: CVE-2026-58505. Severity: high. CVSS: 7.5. KEV: no. Product: @maplibre/geojson-vt (< 6.1.1). Brief: MapLibre: geojson-vt stack exhaustion denial-of-service (CVE-2026-58505). Brief link: https://feed.craftedsignal.io/briefs/2026-11-geojson-vt-dos-cve-2026-58505/
Triage facts
Revision 1- Applicability
- @maplibre/geojson-vt (< 6.1.1)
- Evidence
- Unknown
- Severity
- Low
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 22:09 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
@maplibre/geojson-vt contains an uncontrolled recursion vulnerability (CVE-2026-58505) in its GeoJSON conversion logic. When a GeoJSONVT instance is constructed with a deeply nested GeometryCollection object, the mutually recursive functions featureToInternal and convertGeometryCollection in src/convert.ts exhaust the Node.js call stack, causing an unhandled RangeError: Maximum call stack size exceeded that terminates the process.
Impact
Because the library is used in server-side tile services that accept GeoJSON over the network, a remote unauthenticated attacker can trigger a denial-of-service by sending a single crafted payload.
Recommendation
- Update the @maplibre/geojson-vt library to version 6.1.1, which contains the patch for this issue.