Uncontrolled Resource Consumption in plist.js Affects Node.js Applications

CVE-2026-124078

What is CVE-2026-124078?

The plist.js npm package before version 5.0.1 is susceptible to an uncontrolled resource consumption vulnerability in its binary property-list parser (parseBinary). This flaw allows unauthenticated attackers to exploit the recursive resolution of shared object references within arrays and dictionaries. By crafting a binary plist of less than 200 bytes, attackers can trigger excessive resolution calls that lead to significant memory growth, resulting in an unrecoverable out-of-memory crash. This vulnerability poses a serious risk for Node.js applications relying on plist.js.

References