CVE-2026-97058

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-97058
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97058.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-97058
Downstream
Published
2026-09-24T13:51:58Z
Modified
2026-09-26T03:48:30Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
sprintf-js through 1.1.3 Denial of Service via Unbounded Precision
Details

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations with minimal payload.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-1284"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97058.json"
}
References

Affected packages

Git / github.com/alexei/sprintf.js

Affected ranges

Type
GIT
Repo
https://github.com/alexei/sprintf.js
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3a0d8c26d291b5bd9f1974877ecc50739921d6f5
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "1.1.3"
        },
        {
            "fixed":  "1.1.3"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
v0.*
v0.2
v0.3
v0.4
v0.5
v0.6
v0.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97058.json"