CVE-2026-58505 · Package
NO FIX YET · SEE WHAT TO DO
A deeply nested GeometryCollection passed to the geojson-vt library exhausts the call stack during conversion, throwing an unhandled RangeError that terminates the process. An unauthenticated remote attacker can crash a server that accepts GeoJSON over the network with one crafted request.
first public Jul 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Server-side tile services that accept GeoJSON from network clients and pass it to GeoJSONVT are exposed to a single-request crash. Browser-only use, where the data never comes from an untrusted network client, is not affected by remote input.
Not affected if browser-only, no-untrusted-geojson-input
Who cares geospatial, maplibre, node.js, tile-server
npm ls geojson-vt @maplibre/geojson-vt or npm ls @maplibre/geojson-vt.GeoJSONVT from request bodies or uploaded GeoJSON.@maplibre/geojson-vt 6.1.1 (fixed in this version; sources do not say which other package names are affected).geojson-vt is a JavaScript library for slicing GeoJSON data into vector tiles on the fly, primarily designed to enable rendering and interacting with large geospatial datasets on the browser side (without a server). Prior to version 6.1.1, @maplibre/geojson-vt contains an uncontrolled recursion vulnerability in its GeoJSON conversion logic. When a GeoJSONVT instance is constructed with a deeply nested GeometryCollection object, the mutually recursive functions featureToInternal and convertGeometryCollection in src/convert.ts exhaust the Node.js call stack, causing an unhandled RangeError: Maximum call stack size exceeded that terminates the process. Because the library is widely used in server-side tile services that accept GeoJSON over the network, a remote unauthenticated attacker can trigger a denial-of-service by sending a single crafted payload. No authentication is required, and no non-default library options are needed. This issue has been patched in version 6.1.1.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.