{"id":"CVE-2026-124683","kind":"vulnerability","aliases":["CVE-2026-124683"],"related":[],"title":"Langium: crafted indented documents stall Node.js event loop via quadratic tokenizing","description":"Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in IndentationAwareTokenBuilder and IndentationAwareLexer. When producing DEDENT tokens, the token builder recomputes line numbers by re-scanning the entire preceding document text. A document whose indentation changes on most lines then takes quadratic time to tokenize. Because tokenization is synchronous, a crafted document of a few hundred kilobytes can block the Node.js event loop for tens of seconds. That causes a DoS for every user served by the same process. Languages built with the DefaultLexer and DefaultTokenBuilder are unaffected.","summary":"Eclipse Langium versions 3.2.0 through 4.4.0 re-scan the whole preceding document for each DEDENT token in the opt-in indentation-aware lexer, so tokenizing takes quadratic time. A crafted document of a few hundred kilobytes can block the Node.js event loop for tens of seconds, denying service to every user of that process.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dsl-tooling","langium","language-servers","node.js","package"],"not_affected_if":["default-lexer","trusted-input-only"],"how_to_check":"- Check whether the project depends on `langium` in `package.json` or the lockfile, and note the resolved version.\n- Look for use of `IndentationAwareTokenBuilder` or `IndentationAwareLexer` in the language grammar setup; languages built with `DefaultLexer` and `DefaultTokenBuilder` are unaffected.\n- Confirm whether the service tokenizes untrusted user-supplied documents in a synchronous path.","fix":"- Langium: move to a version outside the affected range `3.2.0` through `4.4.0`; the sources do not name the exact fixed release.","status":"open","published_at":"2026-11-09T17:17:27+00:00","first_seen_at":"2026-11-09T17:27:39+00:00","triaged_at":"2026-11-09T17:28:44+00:00","updated_at":"2026-11-09T17:28:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T17:28:44Z","model":"claude-haiku-5-5","output":{"fix":"- Langium: move to a version outside the affected range `3.2.0` through `4.4.0`; the sources do not name the exact fixed release.","reach":"network","title":"Langium: crafted indented documents stall Node.js event loop via quadratic tokenizing","impact":"medium","summary":"Eclipse Langium versions 3.2.0 through 4.4.0 re-scan the whole preceding document for each DEDENT token in the opt-in indentation-aware lexer, so tokenizing takes quadratic time. A crafted document of a few hundred kilobytes can block the Node.js event loop for tens of seconds, denying service to every user of that process.","audience":"developers","category":"package","nicknames":[],"who_cares":["langium","node.js","language-servers","dsl-tooling"],"confidence":0.7,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Denial of service blocking the Node.js event loop for all users","analyst_note":"Find the fixed Langium release and confirm it in the vendor advisory linked from the GitHub advisory.","how_to_check":"- Check whether the project depends on `langium` in `package.json` or the lockfile, and note the resolved version.\n- Look for use of `IndentationAwareTokenBuilder` or `IndentationAwareLexer` in the language grammar setup; languages built with `DefaultLexer` and `DefaultTokenBuilder` are unaffected.\n- Confirm whether the service tokenizes untrusted user-supplied documents in a synchronous path.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-lexer","trusted-input-only"],"who_is_affected":"Only applications that use Langium's opt-in IndentationAwareTokenBuilder or IndentationAwareLexer and tokenize documents an outside party can supply are exposed. Applications using DefaultLexer and DefaultTokenBuilder, or only trusted input, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000825,"input_tokens":4722,"output_tokens":705,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124683':14A,17A '-2026':13A,16A '-407':97C '3.2.0':30B,87C '4.4.0':32B,89C 'algorithm':93C 'awar':51B 'block':67B,152C 'builder':112C 'built':174C 'caus':162C 'chang':129C 'complex':94C 'contain':90C 'craft':2A,59B,144C 'cve':12A,15A 'cwe':96C 'dedent':42B,108C 'defaultlex':177C 'defaulttokenbuild':179C 'deni':76B 'document':4A,39B,60B,123C,126C,145C 'dos':164C 'dsl':19B 'dsl-tool':18B 'eclips':27B,84C 'entir':121C 'event':7A,70B,155C 'everi':79B,166C 'hundr':64B,149C 'indent':3A,50B,128C 'indentation-awar':49B 'indentationawarelex':105C 'indentationawaretokenbuild':103C 'ineffici':92C 'issu':95C 'kilobyt':65B,150C 'langium':1A,21B,28B,85C 'languag':23B,173C 'language-serv':22B 'lexer':52B 'line':114C,132C 'loop':8A,71B,156C 'node.js':6A,25B,69B,154C 'number':115C 'opt':47B,101C 'opt-in':46B,100C 'packag':26B 'preced':38B,122C 'process':83B,172C 'produc':107C 'quadrat':10A,56B,135C 're':34B,118C 're-scan':33B,117C 'recomput':113C 'scan':35B,119C 'second':75B,160C 'serv':168C 'server':24B 'servic':77B 'stall':5A 'synchron':142C 'take':55B,134C 'ten':73B,158C 'text':124C 'time':57B,136C 'token':11A,43B,54B,109C,111C,138C,140C 'tool':20B 'unaffect':181C 'user':80B,167C 'version':29B,86C 'via':9A 'whole':37B 'whose':127C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use Langium's opt-in IndentationAwareTokenBuilder or IndentationAwareLexer and tokenize documents an outside party can supply are exposed. Applications using DefaultLexer and DefaultTokenBuilder, or only trusted input, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dsltooling","high","langium","languageservers","nodejs","package"],"campaign_type":null,"search_a":"'-124683':14A,17A '-2026':13A,16A 'craft':2A 'cve':12A,15A 'document':4A 'event':7A 'indent':3A 'langium':1A 'loop':8A 'node.js':6A 'quadrat':10A 'stall':5A 'token':11A 'via':9A","search_b":"'3.2.0':30B '4.4.0':32B 'awar':51B 'block':67B 'craft':59B 'dedent':42B 'deni':76B 'document':39B,60B 'dsl':19B 'dsl-tool':18B 'eclips':27B 'event':70B 'everi':79B 'hundr':64B 'indent':50B 'indentation-awar':49B 'kilobyt':65B 'langium':21B,28B 'languag':23B 'language-serv':22B 'lexer':52B 'loop':71B 'node.js':25B,69B 'opt':47B 'opt-in':46B 'packag':26B 'preced':38B 'process':83B 'quadrat':56B 're':34B 're-scan':33B 'scan':35B 'second':75B 'server':24B 'servic':77B 'take':55B 'ten':73B 'time':57B 'token':43B,54B 'tool':20B 'user':80B 'version':29B 'whole':37B","search_c":"'-407':97C '3.2.0':87C '4.4.0':89C 'algorithm':93C 'block':152C 'builder':112C 'built':174C 'caus':162C 'chang':129C 'complex':94C 'contain':90C 'craft':144C 'cwe':96C 'dedent':108C 'defaultlex':177C 'defaulttokenbuild':179C 'document':123C,126C,145C 'dos':164C 'eclips':84C 'entir':121C 'event':155C 'everi':166C 'hundr':149C 'indent':128C 'indentationawarelex':105C 'indentationawaretokenbuild':103C 'ineffici':92C 'issu':95C 'kilobyt':150C 'langium':85C 'languag':173C 'line':114C,132C 'loop':156C 'node.js':154C 'number':115C 'opt':101C 'opt-in':100C 'preced':122C 'process':172C 'produc':107C 'quadrat':135C 're':118C 're-scan':117C 'recomput':113C 'scan':119C 'second':160C 'serv':168C 'synchron':142C 'take':134C 'ten':158C 'text':124C 'time':136C 'token':109C,111C,138C,140C 'unaffect':181C 'user':167C 'version':86C 'whose':127C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T17:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124683","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124683","severity":null,"published_at":"2026-11-09T17:17:27+00:00","modified_at":"2026-11-09T17:17:27+00:00","first_seen_at":"2026-11-09T17:27:39+00:00","fetched_at":"2026-11-09T17:27:39+00:00","note":null}],"documents":[{"id":108525,"url":"https://github.com/eclipse-langium/langium/security/advisories/GHSA-297v-g8mm-qj4h","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}