Denial of Service Vulnerability in sprintf-js by Alexei
CVE-2026-97058

6.9MEDIUM

Key Information:

Vendor

Alexei

Status
Sprintf-js
Vendor
CVE Published:
24 September 2026

What is CVE-2026-97058?

The sprintf-js library, specifically versions up to 1.1.3, allows for unbounded precision specifiers without adequate validation, which can lead to uncaught RangeError exceptions. This vulnerability enables attackers to control format strings and inject precision values that exceed ECMAScript limits, resulting in potential disruptions to application functionality. If exploited, this could lead to operations being aborted due to the maliciously crafted payloads.

Affected Version(s)

sprintf-js 0 <= 1.1.3

References

https://github.com/alexei/sprintf.js/issues/237
issue-tracking
https://github.com/alexei/sprintf.js/blob/3a0d8c26d291b5b...
technical-description
https://github.com/alexei/sprintf.js/blob/3a0d8c26d291b5b...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wayde Shi (PayPal Cyber Security Team)
.