{"id":"CVE-2026-124078","kind":"vulnerability","aliases":["CVE-2026-124078"],"related":[],"title":"plist npm package: crafted binary plist causes exponential memory use and crash","description":"plist.js (npm package 'plist') before 5.0.1 contains an uncontrolled resource consumption vulnerability in the binary property-list parser (parseBinary) that allows unauthenticated attackers to crash a Node.js process by exploiting unmemoized recursive resolution of shared object references for arrays and dictionaries. Attackers can craft a small binary plist (under 200 bytes) containing chained self-referencing object indices to trigger exponential (2^N) resolution calls and memory growth, causing an unrecoverable out-of-memory crash and denial of service.","summary":"The plist npm package before 5.0.1 has an uncontrolled resource consumption flaw in its binary property-list parser. A small crafted binary plist with chained self-referencing object indices triggers exponential resolution, exhausting memory and crashing the Node.js process.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node.js","npm","package","plist"],"not_affected_if":["no-untrusted-input","xml-only-parsing"],"how_to_check":"- Check the installed version with `npm ls plist` in each project and look for any version below `5.0.1`.\n- Find places where the app parses binary plist input from untrusted sources by searching for `parseBinary` or `require('plist')`.","fix":"- `plist` (npm) before `5.0.1`: move to `5.0.1` or later.","status":"open","published_at":"2026-11-06T21:17:08+00:00","first_seen_at":"2026-11-06T21:45:07+00:00","triaged_at":"2026-11-06T21:46:34+00:00","updated_at":"2026-11-06T21:46:34+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T21:46:34Z","model":"claude-haiku-5-5","output":{"fix":"- `plist` (npm) before `5.0.1`: move to `5.0.1` or later.","reach":"unknown","title":"plist npm package: crafted binary plist causes exponential memory use and crash","impact":"medium","summary":"The plist npm package before 5.0.1 has an uncontrolled resource consumption flaw in its binary property-list parser. A small crafted binary plist with chained self-referencing object indices triggers exponential resolution, exhausting memory and crashing the Node.js process.","audience":"developers","category":"package","nicknames":[],"who_cares":["node.js","npm","plist"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated attacker crashes the Node.js process via out-of-memory","analyst_note":"","how_to_check":"- Check the installed version with `npm ls plist` in each project and look for any version below `5.0.1`.\n- Find places where the app parses binary plist input from untrusted sources by searching for `parseBinary` or `require('plist')`.","plain_action":"","needs_analyst":false,"not_affected_if":["xml-only-parsing","no-untrusted-input"],"who_is_affected":"Applications that run the plist npm package to parse binary property lists, especially where the input comes from outside the organisation (uploads, network data, untrusted files). Projects that only parse XML plists or never feed it external binary plists are less exposed. The sources do not say whether the flaw is reachable through any particular default configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000712,"input_tokens":4367,"output_tokens":550,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124078':15A,18A '-2026':14A,17A '2':126C '200':114C '5.0.1':28B,69C 'allow':85C 'array':103C 'attack':87C,106C 'binari':5A,37B,45B,78C,111C 'byte':115C 'call':129C 'caus':7A,133C 'chain':48B,117C 'consumpt':33B,74C 'contain':70C,116C 'craft':4A,44B,108C 'crash':12A,60B,89C,140C 'cve':13A,16A 'denial':142C 'dictionari':105C 'exhaust':57B 'exploit':94C 'exponenti':8A,55B,125C 'flaw':34B 'growth':132C 'indic':53B,122C 'list':40B,81C 'memori':9A,58B,131C,139C 'n':127C 'node.js':19B,62B,91C 'npm':2A,20B,25B,65C 'object':52B,100C,121C 'out-of-memori':136C 'packag':3A,21B,26B,66C 'parsebinari':83C 'parser':41B,82C 'plist':1A,6A,22B,24B,46B,67C,112C 'plist.js':64C 'process':63B,92C 'properti':39B,80C 'property-list':38B,79C 'recurs':96C 'refer':101C 'referenc':51B,120C 'resolut':56B,97C,128C 'resourc':32B,73C 'self':50B,119C 'self-referenc':49B,118C 'servic':144C 'share':99C 'small':43B,110C 'trigger':54B,124C 'unauthent':86C 'uncontrol':31B,72C 'unmemo':95C 'unrecover':135C 'use':10A 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Applications that run the plist npm package to parse binary property lists, especially where the input comes from outside the organisation (uploads, network data, untrusted files). Projects that only parse XML plists or never feed it external binary plists are less exposed. The sources do not say whether the flaw is reachable through any particular default configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","nodejs","npm","package","plist"],"campaign_type":null,"search_a":"'-124078':15A,18A '-2026':14A,17A 'binari':5A 'caus':7A 'craft':4A 'crash':12A 'cve':13A,16A 'exponenti':8A 'memori':9A 'npm':2A 'packag':3A 'plist':1A,6A 'use':10A","search_b":"'5.0.1':28B 'binari':37B,45B 'chain':48B 'consumpt':33B 'craft':44B 'crash':60B 'exhaust':57B 'exponenti':55B 'flaw':34B 'indic':53B 'list':40B 'memori':58B 'node.js':19B,62B 'npm':20B,25B 'object':52B 'packag':21B,26B 'parser':41B 'plist':22B,24B,46B 'process':63B 'properti':39B 'property-list':38B 'referenc':51B 'resolut':56B 'resourc':32B 'self':50B 'self-referenc':49B 'small':43B 'trigger':54B 'uncontrol':31B","search_c":"'2':126C '200':114C '5.0.1':69C 'allow':85C 'array':103C 'attack':87C,106C 'binari':78C,111C 'byte':115C 'call':129C 'caus':133C 'chain':117C 'consumpt':74C 'contain':70C,116C 'craft':108C 'crash':89C,140C 'denial':142C 'dictionari':105C 'exploit':94C 'exponenti':125C 'growth':132C 'indic':122C 'list':81C 'memori':131C,139C 'n':127C 'node.js':91C 'npm':65C 'object':100C,121C 'out-of-memori':136C 'packag':66C 'parsebinari':83C 'parser':82C 'plist':67C,112C 'plist.js':64C 'process':92C 'properti':80C 'property-list':79C 'recurs':96C 'refer':101C 'referenc':120C 'resolut':97C,128C 'resourc':73C 'self':119C 'self-referenc':118C 'servic':144C 'share':99C 'small':110C 'trigger':124C 'unauthent':86C 'uncontrol':72C 'unmemo':95C 'unrecover':135C 'vulner':75C","first_public_at":"2026-11-06T21:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124078","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124078","severity":null,"published_at":"2026-11-06T21:17:08+00:00","modified_at":"2026-11-06T21:17:08+00:00","first_seen_at":"2026-11-06T21:45:07+00:00","fetched_at":"2026-11-06T21:45:07+00:00","note":null}],"documents":[{"id":90306,"url":"https://github.com/TooTallNate/plist.js/commit/ac871e67aa0b0440da50bf40d58c6deddce9d8c1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90307,"url":"https://github.com/TooTallNate/plist.js/releases/tag/plist%405.0.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":90308,"url":"https://www.vulncheck.com/advisories/plist-js-before-uncontrolled-resource-consumption-via-binary-parser","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}