The vulnerability is an uncontrolled resource consumption flaw in the binary property‑list parser of the plist.js npm package, described as an unmemoized recursive resolution of shared references. An unauthenticated attacker can supply a specially crafted binary plist file less than 200 bytes in size that contains chained self‑referencing indices, causing exponential (2^N) resolution calls and rapid memory growth. The result is an unrecoverable out‑of‑memory crash that terminates the Node.js process, leading to a denial of service.

Vendors impacted include TooTallNate, the maintainer of the plist.js library. All releases of the package prior to version 5.0.1 are vulnerable. Systems that rely on the library—particularly Node.js applications that parse binary property‑list files—must check for the installed package version and update to 5.0.1 or later. Any environment that loads the library for parsing externally supplied plists is a potential attack surface.

The CVSS score of 8.7 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting no confirmed exploits yet. The flaw requires an attacker to be able to invoke the parseBinary function with crafted input; no authentication is required. While the description does not state how the library is exposed, any publicly accessible API or local process that accepts binary plist data could be abused. Due to the small size of the payload and exponential resource growth, attackers could trigger denial of service with minimal bandwidth and compute resources, making the threat realistic in both local and remote contexts.