# CVE-2026-124078

Crafted binary plist triggers exponential recursion in plist.js, crashing Node.js processes.

- Page: https://www.vulneraibility.com/cve/CVE-2026-124078
- CVSS: 8.7
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-776, CWE-674
- Published: 2026-11-06

## Affected versions

- TooTallNate plist.js: affected < 5.0.1

A version outside these ranges is not a statement that it is unaffected.

## Impact

Unauthenticated remote Denial of Service: crafted binary plist causes exponential resolution, OOM and crash of Node.js applications.

## Action

Immediate action required

## Recommendation

Upgrade to plist 5.0.1; block or validate untrusted binary plist inputs.

## References

- [patch] https://github.com/TooTallNate/plist.js/releases/tag/plist%405.0.1
- [other] https://github.com/TooTallNate/plist.js/commit/ac871e67aa0b0440da50bf40d58c6deddce9d8c1
- [advisory] https://www.vulncheck.com/advisories/plist-js-before-uncontrolled-resource-consumption-via-binary-parser

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.