Medium severity5.3NVD Advisory· Published Sep 24, 2026· Updated Sep 24, 2026
CVE-2026-97058
CVE-2026-97058
Description
sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations with minimal payload.
Affected products
1- Range: <=1.1.3
Patches
Vulnerability mechanics
References
4- github.com/alexei/sprintf.js/blob/3a0d8c26d291b5bd9f1974877ecc50739921d6f5/src/sprintf.jsnvd
- github.com/alexei/sprintf.js/blob/3a0d8c26d291b5bd9f1974877ecc50739921d6f5/src/sprintf.jsnvd
- github.com/alexei/sprintf.js/issues/237nvd
- www.vulncheck.com/advisories/sprintf-js-through-1.1.3-denial-of-service-via-unbounded-precisionnvd
News mentions
0No linked articles in our index yet.