CVE-2026-97058

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations with minimal payload.

  • Published Sep 24, 2026
  • CVSS 6.9 medium
  • 0.4% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-97058 at the National Vulnerability Database