{"metadata": {"vulnerability": "CVE-2026-58505", "count": 7, "kinds": {"milestone": 3, "sighting": 1, "kev": 0, "other": 3}, "linked_omitted": 0}, "data": [{"timestamp": "2026-06-30T20:21:25.813Z", "date_only": false, "value": "2026-06-30T20:21:25.813Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-58505", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-11T18:19:59.296Z", "date_only": false, "value": "2026-11-11T18:19:59.296Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-58505", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-11T18:19:59.296Z", "date_only": false, "value": "2026-11-11T18:19:59.296Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-58505", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-11T18:19:59.296Z", "date_only": false, "value": "2026-11-11T18:19:59.296Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-58505", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-11T19:10:42.875Z", "date_only": false, "value": "2026-11-11T19:10:42.875466Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117599387138197456", "record": "CVE-2026-58505", "field": "creation_timestamp", "uuid": "15a1eb11-efd6-42b8-96fb-5b3d3ee7991b", "content": "CVE-2026-58505 geojson-vt: Uncontrolled Recursion in Nested GeoJSON GeometryCollection geojson-vt is a JavaScript library for slicing GeoJSON data into vector tiles on the fly, primarily designed to enable rendering and interacting with large geospatial datasets on the browser side (without a server). Prior to version 6.1.1, @maplibre/geojson-vt contains an uncontrolled recursion vulnerability in its GeoJSON conversion logic. When a GeoJSONVT instance is constructed with a deeply nested GeometryCollection object, the mutually recursive functions featureToInternal and convertGeometryCollection in src/convert.ts exhaust the Node.js call stack, causing an unhandled RangeError: Maximum call stack size exceeded that terminates the process. Because the library is widely used in server-side tile services that accept GeoJSON over the network, a remote unauthenticated attacker can trigger a denial-of-service by sending a single crafted payload. No authentication is required, and no non-default library options are needed. This issue has been patched in version 6.1.1.\nhttps://www.cve.org/CVERecord?id=CVE-2026-58505https://github.com/maplibre/geojson-vt/security/advisories/GHSA-75qh-632x-j5prhttps://github.com/maplibre/geojson-vt/pull/156https://github.com/maplibre/geojson-vt/commit/cb85688270d80894ce377969c75e631fe4b04c82https://github.com/maplibre/geojson-vt/releases/tag/v6.1.1#maplibre #geojson-vt#CVE_2026_58505#bot", "url": "https://infosec.exchange/users/cve/statuses/117599387138197456"}, {"timestamp": "2026-11-11T19:17:42.580Z", "date_only": false, "value": "2026-11-11T19:17:42.580", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-58505", "record": "FKIE_CVE-2026-58505", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T19:17:42.580Z", "date_only": false, "value": "2026-11-11T19:17:42.580", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-58505", "record": "FKIE_CVE-2026-58505", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-12T05:20:24.001Z", "anchors": {"origin": {"timestamp": "2026-11-11T18:19:59.296Z", "date_only": false, "value": "2026-11-11T18:19:59.296Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-58505", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-11T18:19:59.296Z", "date_only": false, "value": "2026-11-11T18:19:59.296Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-58505", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 39624.705655, "hours": 11.006862681944444, "days": 0.45861927841435185, "min_seconds": 39624.705655, "max_seconds": 39624.705655, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-11T18:19:59.296Z", "date_only": false, "value": "2026-11-11T18:19:59.296Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-58505", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-12T05:20:24.001Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}