{"affected":[{"product":"geojson-vt","source":"CNA: GitHub_M","vendor":"maplibre","versions":[{"status":"affected","version":"< 6.1.1"}]}],"cveId":"CVE-2026-58505","cwes":["CWE-674"],"description":"geojson-vt is a JavaScript library for slicing GeoJSON data into vector tiles on the fly, primarily designed to enable rendering and interacting with large geospatial datasets on the browser side (without a server). Prior to version 6.1.1, @maplibre/geojson-vt contains an uncontrolled recursion vulnerability in its GeoJSON conversion logic. When a GeoJSONVT instance is constructed with a deeply nested GeometryCollection object, the mutually recursive functions featureToInternal and convertGeometryCollection in src/convert.ts exhaust the Node.js call stack, causing an unhandled RangeError: Maximum call stack size exceeded that terminates the process. Because the library is widely used in server-side tile services that accept GeoJSON over the network, a remote unauthenticated attacker can trigger a denial-of-service by sending a single crafted payload. No authentication is required, and no non-default library options are needed. This issue has been patched in version 6.1.1.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794421199296,"publishedAt":1794421199296,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/maplibre/geojson-vt/security/advisories/GHSA-75qh-632x-j5pr"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/maplibre/geojson-vt/pull/156"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/maplibre/geojson-vt/commit/cb85688270d80894ce377969c75e631fe4b04c82"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/maplibre/geojson-vt/releases/tag/v6.1.1"}],"remediation":[],"revision":"27b997872aafd708e623d91a19f88e86e2a8db66d1c8670d193aa156826d3ae3","sources":[{"modifiedAt":1794421199296,"name":"CNA: GitHub_M","retrievedAt":1794424150098,"url":"https://www.cve.org/CVERecord?id=CVE-2026-58505"}],"ssvc":null,"status":"published","title":"geojson-vt: Uncontrolled Recursion in Nested GeoJSON GeometryCollection","updatedAt":1794424150098}