Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-58505— geojson-vt: Uncontrolled Recursion in Nested GeoJSON GeometryCollection

Quick assessment

Affected
maplibre geojson-vt
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

geojson-vt 是一个 JavaScript 库，用于将 GeoJSON 数据动态切片为矢量瓦片，主要设计用于在浏览器端（无需服务器）渲染和交互大型地理空间数据集。在 6.1.1 版本之前，@maplibre/geojson-vt 在其 GeoJSON 转换逻辑中存在一个不受控制的递归漏洞。当使用深度嵌套的 GeometryCollection 对象构造 GeoJSONVT 实例时，src/convert.ts 中相互递归的函数 featureToInternal 和 convertGeometryColle

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
maplibre geojson-vt < 6.1.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-58505

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
geojson-vt: Uncontrolled Recursion in Nested GeoJSON GeometryCollection
Source: CVE Program / CVE List V5
Vulnerability Description
geojson-vt is a JavaScript library for slicing GeoJSON data into vector tiles on the fly, primarily designed to enable rendering and interacting with large geospatial datasets on the browser side (without a server). Prior to version 6.1.1, @maplibre/geojson-vt contains an uncontrolled recursion vulnerability in its GeoJSON conversion logic. When a GeoJSONVT instance is constructed with a deeply nested GeometryCollection object, the mutually recursive functions featureToInternal and convertGeometryCollection in src/convert.ts exhaust the Node.js call stack, causing an unhandled RangeError: Maximum call stack size exceeded that terminates the process. Because the library is widely used in server-side tile services that accept GeoJSON over the network, a remote unauthenticated attacker can trigger a denial-of-service by sending a single crafted payload. No authentication is required, and no non-default library options are needed. This issue has been patched in version 6.1.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的递归
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
maplibre geojson-vt < 6.1.1 -

II. Public POCs for CVE-2026-58505

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-58505

请登录查看更多情报信息。

Other References for CVE-2026-58505 (4)

IV. Related Vulnerabilities

Same vendor: maplibre
Same weakness: CWE-674