high severity · published 2026-11-09
A crafted document with changing indentation makes tokenization take quadratic time, blocking the Node.js event loop for tens of seconds. Every user served by the same process is then denied service.
CVE: CVE-2026-124683
Source: NVD
FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 1956 and your operating system.