Advisory · CVE-2026-124078
plist.js binary parser denial of service via crafted property list
The npm package plist before 5.0.1 lets unauthenticated attackers crash a Node.js process with a small crafted binary plist, because parseBinary resolves shared object references recursively without memoization, causing exponential resolution calls and out-of-memory growth.
- Vendor
- TooTallNate
- Product
- plist.js
- Identifier / CWE
- CVE-2026-124078
CWE-674, CWE-776 - Action timing
- Immediate
Explain it like I’m five
The parser reads a tiny file that says see item one, which says see item one, in an ever-growing chain. It follows every branch without remembering where it has been, until the program runs out of memory and dies.
- 01Crafted plist delivered
An unauthenticated attacker supplies a small binary plist, under 200 bytes, containing chained self-referencing object indices.
- 02Parser recurses
parseBinary resolves shared object references recursively without memoizing results.
- 03Calls grow exponentially
Each shared reference doubles the work, producing exponential resolution calls and memory growth.
- 04Process crashes
The Node.js process runs out of memory and crashes, an unrecoverable denial of service.
What happened
The npm package plist before 5.0.1 contains an uncontrolled resource consumption vulnerability in the binary property-list parser. parseBinary resolves shared object references recursively without memoization, so a crafted binary plist under 200 bytes containing chained self-referencing object indices triggers exponential resolution calls and memory growth, crashing the Node.js process with an unrecoverable out-of-memory error. The record rates it high at CVSS 8.7 under version 4.0 and 7.5 under version 3.1. The impact is availability only: the record carries no confidentiality or integrity impact.
The fix is in plist 5.0.1, whose release notes confirm the change: objects referenced multiple times are now parsed only once, circular references are rejected, and trailer, offset table, and object references are validated against the input bounds. plist is a widely used npm package for parsing Apple property lists, so exposure depends on where untrusted binary plists reach a Node service, directly or through a dependency.
What to do
- Find plist usage in Node services, including transitive dependencies, and record each version.
- Upgrade to plist 5.0.1 or later.
- Until upgraded, avoid parsing untrusted binary plists, or isolate the parser so a crash cannot take down the service.
- Treat unexpected Node process restarts or out-of-memory crashes as a possible trigger of this issue and investigate the input.
- Verify the deployed version after updating.
Management note
A 200-byte file killing a process is a cheap availability attack. The fix is a patch bump, but the real work is finding every place untrusted plists enter the system, since the package usually arrives as someone elses dependency.