CVE-2026-97058: sprintf-js through 1.1.3 Denial of Service via Unbounded Precision
sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations with minimal payload.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using npm/sprintf-js through 1.1.3 are exposed when an attacker can influence a format string that the application passes to the library. The impact is limited to availability of the calling operation because malformed precision values trigger an uncaught RangeError.
What does an attacker need to exploit it?
The attacker needs control over all or part of a format string, specifically enough control to supply a precision specifier exceeding ECMAScript limits. No authentication or user interaction is required according to the supplied vector.
How can I determine whether my application is affected?
Check whether your dependency tree includes sprintf-js version 1.1.3 or earlier, then identify calls that process format strings derived from untrusted input. Affected paths can be confirmed by testing an oversized precision specifier and observing whether the operation terminates with an uncaught RangeError.