@@ -11,6 +11,14 @@ var ArraySet = require('./array-set').ArraySet;
 var base64VLQ = require('./base64-vlq');
 var quickSort = require('./quick-sort').quickSort;
 
+// Upper bound for a section's `offset.line` in an indexed source map. A flat
+// map spends one ';' per generated line, so a tiny indexed map with a huge
+// offset.line turns into a huge amount of work and memory once its mappings
+// are copied into a SourceMapGenerator (CVE-2026-93749). Ten million lines is
+// far beyond any real generated file. Columns are VLQ-encoded as deltas and
+// don't amplify, so they only need to be valid integers.
+var MAX_SECTION_OFFSET_LINE = 1e7;
+
 function SourceMapConsumer(aSourceMap, aSourceMapURL) {
   var sourceMap = aSourceMap;
   if (typeof aSourceMap === 'string') {
@@ -935,6 +943,7 @@ function IndexedSourceMapConsumer(aSourceMap, aSourceMapURL) {
     line: -1,
     column: 0
   };
+  var maxOffsetLine = 0;
   this._sections = sections.map(function (s) {
     if (s.url) {
       // The url field will require support for asynchronicity.
@@ -945,22 +954,57 @@ function IndexedSourceMapConsumer(aSourceMap, aSourceMapURL) {
     var offsetLine = util.getArg(offset, 'line');
     var offsetColumn = util.getArg(offset, 'column');
 
+    if (!isValidOffset(offsetLine) || !isValidOffset(offsetColumn)) {
+      throw new Error('Section offset line and column must be non-negative integers.');
+    }
+    if (offsetLine > MAX_SECTION_OFFSET_LINE) {
+      throw new Error('Section offset line must not exceed ' + MAX_SECTION_OFFSET_LINE + '.');
+    }
+
     if (offsetLine < lastOffset.line ||
         (offsetLine === lastOffset.line && offsetColumn < lastOffset.column)) {
       throw new Error('Section offsets must be ordered and non-overlapping.');
     }
     lastOffset = offset;
 
+    var consumer = new SourceMapConsumer(util.getArg(s, 'map'), aSourceMapURL);
+
+    // Offsets of a nested indexed map add up with this one, so apply the
+    // bound to the total.
+    var totalOffsetLine = offsetLine + (consumer._maxOffsetLine || 0);
+    if (totalOffsetLine > MAX_SECTION_OFFSET_LINE) {
+      throw new Error('Section offset line must not exceed ' + MAX_SECTION_OFFSET_LINE +
+                      ', including offsets of nested sections.');
+    }
+    if (totalOffsetLine > maxOffsetLine) {
+      maxOffsetLine = totalOffsetLine;
+    }
+
     return {
       generatedOffset: {
         // The offset fields are 0-based, but we use 1-based indices when
         // encoding/decoding from VLQ.
         generatedLine: offsetLine + 1,
         generatedColumn: offsetColumn + 1
       },
-      consumer: new SourceMapConsumer(util.getArg(s, 'map'), aSourceMapURL)
+      consumer: consumer
     }
   });
+
+  // The largest offset.line of any section, including nested sections.
+  this._maxOffsetLine = maxOffsetLine;
+}
+
+/**
+ * Section offsets come from untrusted input and are used as line/column
+ * numbers, so only accept non-negative safe integers (rejects NaN, Infinity,
+ * strings, fractions, etc).
+ */
+function isValidOffset(aValue) {
+  return typeof aValue === 'number' &&
+    aValue >= 0 &&
+    aValue <= 9007199254740991 && // Number.MAX_SAFE_INTEGER
+    Math.floor(aValue) === aValue;
 }
 
 IndexedSourceMapConsumer.prototype = Object.create(SourceMapConsumer.prototype);
@@ -978,8 +1022,12 @@ Object.defineProperty(IndexedSourceMapConsumer.prototype, 'sources', {
   get: function () {
     var sources = [];
     for (var i = 0; i < this._sections.length; i++) {
-      for (var j = 0; j < this._sections[i].consumer.sources.length; j++) {
-        sources.push(this._sections[i].consumer.sources[j]);
+      // Read the getter once per section: for a nested indexed map it is
+      // itself this getter, and re-reading it per item is exponential in the
+      // nesting depth (CVE-2026-93749).
+      var sectionSources = this._sections[i].consumer.sources;
+      for (var j = 0; j < sectionSources.length; j++) {
+        sources.push(sectionSources[j]);
       }
     }
     return sources;
 
@@ -348,10 +348,12 @@ SourceMapGenerator.prototype._serializeMappings =
 
       if (mapping.generatedLine !== previousGeneratedLine) {
         previousGeneratedColumn = 0;
-        while (mapping.generatedLine !== previousGeneratedLine) {
-          next += ';';
-          previousGeneratedLine++;
-        }
+        // One ';' per skipped line. Build large gaps with a single flat
+        // string: appending ';' one by one creates a rope node per line, which
+        // can exhaust the heap for a big gap (CVE-2026-93749).
+        var lineDelta = mapping.generatedLine - previousGeneratedLine;
+        next += lineDelta === 1 ? ';' : ';'.repeat(lineDelta);
+        previousGeneratedLine = mapping.generatedLine;
       }
       else {
         if (i > 0) {
 
@@ -113,6 +113,13 @@ SourceNode.fromStringWithSourceMap =
       // to the SourceNode without any mapping.
       // Each line is added as separate string.
       while (lastGeneratedLine < mapping.generatedLine) {
+        if (remainingLinesIndex >= remainingLines.length) {
+          // The generated code is exhausted. Skip the rest instead of adding
+          // empty lines one by one: a mapping may point far past the end of
+          // the code (e.g. an indexed map section with a huge offset.line).
+          lastGeneratedLine = mapping.generatedLine;
+          break;
+        }
         node.add(shiftNextLine());
         lastGeneratedLine++;
       }
 
@@ -895,6 +895,87 @@ exports['test indexed source map errors when sections are out of order by line']
   }, Error);
 };
 
+exports['test indexed source map errors on invalid section offsets'] = function(assert) {
+  var invalid = [-1, 1.5, NaN, Infinity, -Infinity, 1e999, 9007199254740992, '1', null, undefined, {}];
+
+  invalid.forEach(function (value) {
+    ['line', 'column'].forEach(function (field) {
+      var map = JSON.parse(JSON.stringify(util.indexedTestMap));
+      map.sections[0].offset[field] = value;
+
+      assert.throws(function() {
+        new SourceMapConsumer(map);
+      }, Error, 'offset.' + field + ' = ' + String(value));
+    });
+  });
+};
+
+exports['test indexed source map errors when section offset line is too large'] = function(assert) {
+  var map = JSON.parse(JSON.stringify(util.indexedTestMap));
+  map.sections[1].offset = { line: 1e7 + 1, column: 0 };
+
+  assert.throws(function() {
+    new SourceMapConsumer(map);
+  }, /must not exceed/);
+};
+
+exports['test indexed source map accepts large valid section offsets'] = function(assert) {
+  var map = JSON.parse(JSON.stringify(util.indexedTestMap));
+  map.sections[0].offset = { line: 0, column: 5000000 };
+  map.sections[1].offset = { line: 1e7, column: 0 };
+
+  var consumer = new SourceMapConsumer(map);
+  var pos = consumer.originalPositionFor({ line: 1e7 + 1, column: 1 });
+  assert.equal(pos.source, '/the/root/two.js');
+  pos = consumer.originalPositionFor({ line: 1, column: 5000001 });
+  assert.equal(pos.source, '/the/root/one.js');
+};
+
+function nestedIndexedMap(depth, offsetLine) {
+  var map = { version: 3, sources: ['a.js'], sourcesContent: ['a'], names: [], mappings: 'AAAA' };
+  for (var i = 0; i < depth; i++) {
+    map = { version: 3, sections: [{ offset: { line: offsetLine, column: 0 }, map: map }] };
+  }
+  return map;
+}
+
+exports['test nested indexed source map offsets add up'] = function(assert) {
+  var consumer = new SourceMapConsumer(nestedIndexedMap(5, 1000));
+  var lines = [];
+  consumer.eachMapping(function (m) { lines.push(m.generatedLine); });
+  assert.deepEqual(lines, [5001]);
+};
+
+exports['test nested indexed source map errors when total offset line is too large'] = function(assert) {
+  // Each level is within the bound, but together they exceed it.
+  new SourceMapConsumer(nestedIndexedMap(2, 5e6));
+  assert.throws(function() {
+    new SourceMapConsumer(nestedIndexedMap(3, 5e6));
+  }, /including offsets of nested sections/);
+};
+
+exports['test nested indexed source map sources is linear in depth'] = function(assert) {
+  // CVE-2026-93749: the sources getter used to re-read each nested
+  // consumer's sources per item, which is exponential in the nesting depth.
+  var depth = 12;
+  var consumer = new SourceMapConsumer(nestedIndexedMap(depth, 1));
+  var innermost = consumer;
+  for (var i = 0; i < depth; i++) {
+    innermost = innermost._sections[0].consumer;
+  }
+  var reads = 0;
+  var innermostSources = innermost.sources;
+  Object.defineProperty(innermost, 'sources', {
+    get: function () {
+      reads++;
+      return innermostSources;
+    }
+  });
+
+  assert.deepEqual(consumer.sources, ['a.js']);
+  assert.equal(reads, 1);
+};
+
 exports['test github issue #64'] = function (assert) {
   var map = new SourceMapConsumer({
     "version": 3,
 
@@ -782,4 +782,40 @@ exports['test that we can create a generator from a source map with empty mappin
   const fromSourceMap = fromConsumer.toJSON();
   assert.ok(fromSourceMap, "Creating a generator from a map with only generated position did not throw");
   assert.equal(fromSourceMap.mappings, originalMap.mappings);
-}
+}
+exports['test serializing large generated line gaps'] = function (assert) {
+  var map = new SourceMapGenerator({ file: 'min.js' });
+  map.addMapping({ generated: { line: 1, column: 0 } });
+  map.addMapping({ generated: { line: 3, column: 0 } });
+  map.addMapping({ generated: { line: 1e6 + 3, column: 0 } });
+
+  var mappings = map.toJSON().mappings;
+  assert.equal(mappings.length, 3 + 2 + 1e6);
+  assert.equal(mappings.slice(0, 4), 'A;;A');
+  assert.equal(mappings.slice(-2), ';A');
+  assert.equal(mappings.indexOf('A', 4), mappings.length - 1);
+};
+
+exports['test copying an indexed map with a large section offset into a generator'] = function (assert) {
+  // CVE-2026-93749: copying mappings from an indexed map with a large
+  // section offset.line must not build the ';' run one rope node at a time.
+  var consumer = new SourceMapConsumer({
+    version: 3,
+    sections: [{
+      offset: { line: 1e7, column: 0 },
+      map: { version: 3, sources: ['a.js'], names: [], mappings: 'AAAA' }
+    }]
+  });
+  var map = new SourceMapGenerator({ file: 'min.js' });
+  consumer.eachMapping(function (m) {
+    map.addMapping({
+      generated: { line: m.generatedLine, column: m.generatedColumn },
+      original: { line: m.originalLine, column: m.originalColumn },
+      source: m.source
+    });
+  });
+
+  var mappings = map.toJSON().mappings;
+  assert.equal(mappings.length, 1e7 + 4);
+  assert.equal(mappings.slice(-5), ';AAAA');
+};
@@ -274,6 +274,43 @@ exports['test .fromStringWithSourceMap() complex version'] = forEachNewline(func
   util.assertEqualMaps(assert, map, inputMap);
 });
 
+exports['test .fromStringWithSourceMap() with indexed map offset past end of code'] = function (assert) {
+  // CVE-2026-93749: a section offset.line far past the end of the code must
+  // not make fromStringWithSourceMap add empty lines one at a time.
+  var map = {
+    version: 3,
+    sections: [{
+      offset: { line: 1e7, column: 0 },
+      map: {
+        version: 3,
+        sources: ['a.js'],
+        sourcesContent: ['a'],
+        names: [],
+        mappings: 'AAAA'
+      }
+    }]
+  };
+
+  var node = SourceNode.fromStringWithSourceMap('var x;\n', new SourceMapConsumer(map));
+  assert.equal(node.toString(), 'var x;\n');
+  assert.ok(node.children.length < 10, node.children.length + ' children');
+};
+
+exports['test .fromStringWithSourceMap() with deeply nested indexed map'] = function (assert) {
+  // CVE-2026-93749: nested indexed maps used to make the sources lookup in
+  // fromStringWithSourceMap exponential in the nesting depth.
+  var map = { version: 3, sources: ['a.js'], sourcesContent: ['a'], names: [], mappings: 'AAAA' };
+  for (var i = 0; i < 40; i++) {
+    map = { version: 3, sections: [{ offset: { line: 0, column: 0 }, map: map }] };
+  }
+
+  var node = SourceNode.fromStringWithSourceMap('var x;\n', new SourceMapConsumer(map));
+  assert.equal(node.toString(), 'var x;\n');
+  var contents = {};
+  node.walkSourceContents(function (source, content) { contents[source] = content; });
+  assert.deepEqual(contents, { 'a.js': 'a' });
+};
+
 exports['test .fromStringWithSourceMap() third argument'] = function (assert) {
   // Assume the following directory structure:
   //