CVE-2026-124683 · Package
NO FIX YET · SEE WHAT TO DO
Eclipse Langium versions 3.2.0 through 4.4.0 re-scan the whole preceding document for each DEDENT token in the opt-in indentation-aware lexer, so tokenizing takes quadratic time. A crafted document of a few hundred kilobytes can block the Node.js event loop for tens of seconds, denying service to every user of that process.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only applications that use Langium's opt-in IndentationAwareTokenBuilder or IndentationAwareLexer and tokenize documents an outside party can supply are exposed. Applications using DefaultLexer and DefaultTokenBuilder, or only trusted input, can skip it.
Not affected if default-lexer, trusted-input-only
Who cares dsl-tooling, langium, language-servers, node.js
langium in package.json or the lockfile, and note the resolved version.IndentationAwareTokenBuilder or IndentationAwareLexer in the language grammar setup; languages built with DefaultLexer and DefaultTokenBuilder are unaffected.Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in IndentationAwareTokenBuilder and IndentationAwareLexer. When producing DEDENT tokens, the token builder recomputes line numbers by re-scanning the entire preceding document text. A document whose indentation changes on most lines then takes quadratic time to tokenize. Because tokenization is synchronous, a crafted document of a few hundred kilobytes can block the Node.js event loop for tens of seconds. That causes a DoS for every user served by the same process. Languages built with the DefaultLexer and DefaultTokenBuilder are unaffected.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
3.2.04.4.0