CVE-2026-124078 · Package
NO FIX YET · SEE WHAT TO DO
The plist npm package before 5.0.1 has an uncontrolled resource consumption flaw in its binary property-list parser. A small crafted binary plist with chained self-referencing object indices triggers exponential resolution, exhausting memory and crashing the Node.js process.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that run the plist npm package to parse binary property lists, especially where the input comes from outside the organisation (uploads, network data, untrusted files). Projects that only parse XML plists or never feed it external binary plists are less exposed. The sources do not say whether the flaw is reachable through any particular default configuration.
Not affected if no-untrusted-input, xml-only-parsing
Who cares node.js, npm, plist
npm ls plist in each project and look for any version below 5.0.1.parseBinary or require('plist').plist (npm) before 5.0.1: move to 5.0.1 or later.plist.js (npm package 'plist') before 5.0.1 contains an uncontrolled resource consumption vulnerability in the binary property-list parser (parseBinary) that allows unauthenticated attackers to crash a Node.js process by exploiting unmemoized recursive resolution of shared object references for arrays and dictionaries. Attackers can craft a small binary plist (under 200 bytes) containing chained self-referencing object indices to trigger exponential (2^N) resolution calls and memory growth, causing an unrecoverable out-of-memory crash and denial of service.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.