rootpwn

medium · CVSS v3 5.3 · CVSS v4 6.9

CVE-2026-97058

sprintf-js 1.1.3 allows attackers to inject unbounded precision specifiers that trigger RangeError exceptions, causing application crashes.

Overview

sprintf-js 1.1.3 allows attackers to inject unbounded precision specifiers that trigger RangeError exceptions, causing application crashes. The flaw is triggered by malicious format strings and can be exploited in any Node.js or JavaScript environment that uses the library. It is a medium‑severity issue that can lead to denial of service.

Description

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations with minimal payload.

Impact

The vulnerability primarily affects Availability, as RangeError exceptions can crash applications or services. It impacts any software that incorporates sprintf‑js, including server‑side Node.js applications, web front‑ends, and any npm package that depends on it.

Remediation

Upgrade sprintf‑js to version 1.1.4 or later, which validates precision specifiers. If an upgrade is not immediately possible, sanitize or whitelist format strings, and wrap formatting calls in try/catch blocks to prevent unhandled exceptions.

Risk context

With a CVSS v3 score of 5.3 and v4 score of 6.9, this medium‑severity issue poses a moderate risk. No EPSS data is available, so defenders should treat it as a standard medium‑risk vulnerability.

Affected products

  • sprintf-js
  • Node.js
  • npm
  • JavaScript
  • web apps

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.3
CVSS v4
6.9
EPSS
—

sprintf-js Node.js Denial of Service JavaScript format-string RangeError

← All CVEs

Related CVEs

medium

CVE-2026-96892

A flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing a manipulation of the argument submit-url can lead to open redirect. The attack may be launched remotely. The exploit has been published and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-96763

A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-96764

A weakness has been identified in kvcache-ai mooncake up to 0.3.12/0.3.14-rc1. Impacted is the function MasterService::GetReplicaListByRegex of the component Regular Expression Handler. Executing a manipulation can lead to allocation of resources. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-96772

A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis