{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/@maplibre/geojson-vt--6.1.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:maplibre:maplibre_geojson_vt:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-58505"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@maplibre/geojson-vt (\u003c 6.1.1)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["MapLibre"],"content_html":"\u003cp\u003e@maplibre/geojson-vt contains an uncontrolled recursion vulnerability (CVE-2026-58505) in its GeoJSON conversion logic. When a GeoJSONVT instance is constructed with a deeply nested GeometryCollection object, the mutually recursive functions featureToInternal and convertGeometryCollection in src/convert.ts exhaust the Node.js call stack, causing an unhandled RangeError: Maximum call stack size exceeded that terminates the process.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eBecause the library is used in server-side tile services that accept GeoJSON over the network, a remote unauthenticated attacker can trigger a denial-of-service by sending a single crafted payload.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the @maplibre/geojson-vt library to version 6.1.1, which contains the patch for this issue.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T22:09:28Z","date_published":"2026-11-11T22:09:28Z","id":"https://feed.craftedsignal.io/briefs/2026-11-geojson-vt-dos-cve-2026-58505/","summary":"The @maplibre/geojson-vt library is vulnerable to an uncontrolled recursion flaw during the processing of nested GeometryCollection objects, allowing a remote unauthenticated attacker to trigger a stack overflow and denial-of-service.","title":"MapLibre: geojson-vt stack exhaustion denial-of-service (CVE-2026-58505)","url":"https://feed.craftedsignal.io/briefs/2026-11-geojson-vt-dos-cve-2026-58505/"}],"language":"en","title":"CraftedSignal Threat Feed - @Maplibre/Geojson-Vt (\u003c 6.1.1)","version":"https://jsonfeed.org/version/1.1"}