---
id: "CVE-2026-124683"
page: "https://infrastack.ai/live/CVE-2026-124683"
kind: "vulnerability"
aliases: ["CVE-2026-124683"]
title: "Langium: crafted indented documents stall Node.js event loop via quadratic tokenizing"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dsl-tooling", "langium", "language-servers", "node.js", "package"]
not_affected_if: ["default-lexer", "trusted-input-only"]
published_at: "2026-11-09T17:17:27+00:00"
first_seen_at: "2026-11-09T17:27:39+00:00"
updated_at: "2026-11-09T17:28:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124683", "first_seen_at": "2026-11-09T17:27:39+00:00"}]
exploit_sources: []
---

# Langium: crafted indented documents stall Node.js event loop via quadratic tokenizing

Link for people: https://infrastack.ai/live/CVE-2026-124683 (this .md is for agents)

Eclipse Langium versions 3.2.0 through 4.4.0 re-scan the whole preceding document for each DEDENT token in the opt-in indentation-aware lexer, so tokenizing takes quadratic time. A crafted document of a few hundred kilobytes can block the Node.js event loop for tens of seconds, denying service to every user of that process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project depends on `langium` in `package.json` or the lockfile, and note the resolved version.
- Look for use of `IndentationAwareTokenBuilder` or `IndentationAwareLexer` in the language grammar setup; languages built with `DefaultLexer` and `DefaultTokenBuilder` are unaffected.
- Confirm whether the service tokenizes untrusted user-supplied documents in a synchronous path.

## Fix

- Langium: move to a version outside the affected range `3.2.0` through `4.4.0`; the sources do not name the exact fixed release.

## Timeline

- 2026-11-09T17:27:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124683

## Documents

- [advisory] Vendor advisory: github.com https://github.com/eclipse-langium/langium/security/advisories/GHSA-297v-g8mm-qj4h

## From the sources

Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in IndentationAwareTokenBuilder and IndentationAwareLexer. When producing DEDENT tokens, the token builder recomputes line numbers by re-scanning the entire preceding document text. A document whose indentation changes on most lines then takes quadratic time to tokenize. Because tokenization is synchronous, a crafted document of a few hundred kilobytes can block the Node.js event loop for tens of seconds. That causes a DoS for every user served by the same process. Languages built with the DefaultLexer and DefaultTokenBuilder are unaffected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_