Uncontrolled Recursion Vulnerability in MapLibre GeoJSON-vt Library

CVE-2026-58505

What is CVE-2026-58505?

The geojson-vt library, used for converting GeoJSON data into vector tiles in JavaScript, has an uncontrolled recursion flaw in its GeoJSON handling logic. An attacker can exploit this issue by sending a carefully crafted deeply nested GeometryCollection object to a GeoJSONVT instance, which causes the library's recursive functions to exhaust the Node.js call stack. This leads to an unhandled RangeError, resulting in a denial-of-service condition. The vulnerability affects applications utilizing this library for server-side tile services and can be triggered without any authentication. A fix has been implemented in version 6.1.1.

References