CVE-2026-58505

Name of the Vulnerable Software and Affected Versions @maplibre/geojson-vt versions prior to 6.1.1

Description An uncontrolled recursion issue exists in the GeoJSON conversion logic. When a GeoJSONVT instance is created using a deeply nested GeometryCollection object, the mutually recursive functions featureToInternal() and convertGeometryCollection() in src/convert.ts exhaust the Node.js call stack. This results in an unhandled RangeError (Maximum call stack size exceeded), which terminates the process. A remote unauthenticated attacker can exploit this by sending a crafted payload to server-side tile services that accept GeoJSON over the network, leading to a denial-of-service.

Recommendations Update to version 6.1.1.