CVE-2026-109149: beautifier js-beautify memory allocation
A weakness has been identified in beautifier js-beautify up to 1.15.1/2.0.3. The affected element is an unknown function. Executing a manipulation can lead to uncontrolled memory allocation. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the npm/js-beautify package at versions up to 1.15.1 or 2.0.3 are identified as affected. The issue can be triggered remotely.
Does exploitation require authentication or user interaction?
No. The supplied CVSS vector indicates network access, low attack complexity, no privileges required, and no user interaction.
What is the likely operational impact?
Successful manipulation can cause uncontrolled memory allocation, with availability impact rated low. The provided scoring indicates no confidentiality or integrity impact.
Is a vendor fix or mitigation available?
No fix or mitigation is provided in the available data. The vendor was contacted early but did not respond.