CVE-2026-97058 alexei CVE debrief

Who should care

Defenders responsible for systems using sprintf-js, especially in applications that accept user-controlled format strings, should assess exposure and prioritize verification and potential updates.

Why it matters

This vulnerability allows attackers to cause denial-of-service attacks with minimal payload by injecting precision values exceeding ECMAScript limits. Defenders should prioritize verifying and updating sprintf-js, assessing exposure in systems using this package, and monitoring for potential attacks.

• Potential denial-of-service attacks with minimal payload
• Need for verification of sprintf-js versions and exposure in systems
• Possible impact on applications accepting user-controlled format strings

Technical summary

The sprintf-js package through version 1.1.3 is vulnerable to a denial-of-service attack due to its handling of unbounded precision specifiers. The package does not validate precision specifiers passed to toFixed, toExponential, and toPrecision methods, leading to uncaught RangeError exceptions. This vulnerability can be exploited by attackers who control format strings, allowing them to inject precision values that exceed ECMAScript limits and abort calling operations with minimal payload.

Defensive priority

Defenders should prioritize verifying and updating sprintf-js to a version beyond 1.1.3 if possible, and assess exposure in systems using this package, especially in applications accepting user-controlled format strings.

Recommended defensive actions

• Verify sprintf-js version and update to a version beyond 1.1.3 if possible
• Assess exposure in systems using sprintf-js, especially in applications accepting user-controlled format strings
• Monitor for potential denial-of-service attacks targeting this vulnerability
• Perform vulnerability scanning to identify systems using sprintf-js
• Review and update incident response plans to address potential exploitation
• Implement additional logging and monitoring for systems using sprintf-js
• Conduct a thorough risk assessment to identify potential impacts on business operations

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, specific details about exploitation or victim impact are not provided, suggesting a need for further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.