CVE-2026-97058
Withdrawn Advisory: sprintf-js vulnerable to denial of service through unbounded precision specifiers
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
What each source reports
GitHub Advisories Score usedGHSA-hp3w-g68c-fv3c
Withdrawn Advisory: sprintf-js vulnerable to denial of service through unbounded precision specifiers
Withdrawn Advisory
This advisory has been withdrawn because it is the responsibility of an application to handle exceptions appropriately. This link is maintained to preserve external references.
Original Description
sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations with minimal payload.
- Record
GHSA-hp3w-g68c-fv3c- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-1284
- Updated
- 2026-11-02
CVE List No score
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
- Record
CVE-2026-97058- Updated
- 2026-11-02
EUVDEUVD-2026-85884
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
- Record
EUVD-2026-85884- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
NVD No score
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
- Record
CVE-2026-97058- Updated
- 2026-11-02
OSV
sprintf-js through 1.1.3 Denial of Service via Unbounded Precision
sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations with minimal payload.
- Record
CVE-2026-97058- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-1284
- Updated
- 2026-11-02
OSVGHSA-hp3w-g68c-fv3c
Withdrawn Advisory: sprintf-js vulnerable to denial of service through unbounded precision specifiers
Withdrawn Advisory
This advisory has been withdrawn because it is the responsibility of an application to handle exceptions appropriately. This link is maintained to preserve external references.
Original Description
sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations with minimal payload.
- Record
GHSA-hp3w-g68c-fv3c- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-1284
- Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2026-97058
sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations with minimal payload.
- Record
UBUNTU-CVE-2026-97058- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVAZL-105069 No score
CVE-2026-97058 affecting package js-jquery 3.5.0-4
sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations with minimal payload.
- Record
AZL-105069- Updated
- 2026-11-02
OSVAZL-105254 No score
CVE-2026-97058 affecting package python-tensorboard 2.16.2-6
sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations with minimal payload.
- Record
AZL-105254- Updated
- 2026-11-02
OSVCLSA-2026-1792700837 No score
TuxCare security update for sprintf-js (1 CVE)
TuxCare rebuilt sprintf-js to address 1 CVE. Fixed in 1.0.3-tuxcare.2.
- Record
CLSA-2026-1792700837- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
js-jqueryAzure Linux:3 |
through 3.5.0-4 | None known |
python-tensorboardAzure Linux:3 |
through 2.16.2-6 | None known |
sprintf-jsTuxCare:npm |
1.0.3-tuxcare.0 up to 1.0.3-tuxcare.2, plus listed versions 1.0.3 |
1.0.3-tuxcare.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-97058 has been rejected by its source and should not be treated as a live vulnerability, published September 24, 2026. Fixed in sprintf-js 1.0.3-tuxcare.2.
References
nvd.nist.gov/vuln/detail/CVE-2026-97058
github.com/alexei/sprintf.js/issues/237
vulncheck.com/advisories/sprintf-js-through-1.1.3-denial-of-service-via-unbounded-precision
ubuntu.com/security/CVE-2026-97058
cve.org/CVERecord?id=CVE-2026-97058