plist.js (npm package 'plist') before 5.0.1 contains an uncontrolled resource consumption vulnerability in the binary property-list parser (parseBinary) that allows unauthenticated attackers to crash a Node.js process by…
CVSS 4.0HIGH 8.7·Network·No auth·No interaction·EPSS 0.00361·Published 2026-11-06·Fixed in 5.0.1CWE-674