Every CVESearch/Get API key

CVE-2026-97058

Withdrawn Advisory: sprintf-js vulnerable to denial of service through unbounded precision specifiers

6.9 MediumFix availableRejected

CVE-2026-97058 has been rejected by its source and should not be treated as a live vulnerability, published September 24, 2026. Fixed in sprintf-js 1.0.3-tuxcare.2.

What does this mean?
Severity
6.9 MediumCVSS 4.0, GitHub Advisories
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1.0.3-tuxcare.2sprintf-js +2 more

Description

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Affected packages

Affected packages
PackageAffectedFixed
js-jquery
Azure Linux:3
through 3.5.0-4None known
python-tensorboard
Azure Linux:3
through 2.16.2-6None known
sprintf-js
TuxCare:npm
1.0.3-tuxcare.0 up to 1.0.3-tuxcare.2, plus listed versions
1.0.3
1.0.3-tuxcare.2

What each source reports

GitHub Advisories Score usedGHSA-hp3w-g68c-fv3c6.9

Withdrawn Advisory: sprintf-js vulnerable to denial of service through unbounded precision specifiers

Withdrawn Advisory

This advisory has been withdrawn because it is the responsibility of an application to handle exceptions appropriately. This link is maintained to preserve external references.

Original Description

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations with minimal payload.

Record
GHSA-hp3w-g68c-fv3c
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-1284
Updated
2026-11-02
CVE ListNo score

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Record
CVE-2026-97058
Updated
2026-11-02
EUVDEUVD-2026-858846.9

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Record
EUVD-2026-85884
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
NVDNo score

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Record
CVE-2026-97058
Updated
2026-11-02
OSV6.9

sprintf-js through 1.1.3 Denial of Service via Unbounded Precision

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations with minimal payload.

Record
CVE-2026-97058
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-1284
Updated
2026-11-02
OSVGHSA-hp3w-g68c-fv3c6.9

Withdrawn Advisory: sprintf-js vulnerable to denial of service through unbounded precision specifiers

Withdrawn Advisory

This advisory has been withdrawn because it is the responsibility of an application to handle exceptions appropriately. This link is maintained to preserve external references.

Original Description

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations with minimal payload.

Record
GHSA-hp3w-g68c-fv3c
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-1284
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2026-970586.9

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations with minimal payload.

Record
UBUNTU-CVE-2026-97058
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-105069No score

CVE-2026-97058 affecting package js-jquery 3.5.0-4

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations with minimal payload.

Record
AZL-105069
Updated
2026-11-02
OSVAZL-105254No score

CVE-2026-97058 affecting package python-tensorboard 2.16.2-6

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations with minimal payload.

Record
AZL-105254
Updated
2026-11-02
OSVCLSA-2026-1792700837No score

TuxCare security update for sprintf-js (1 CVE)

TuxCare rebuilt sprintf-js to address 1 CVE. Fixed in 1.0.3-tuxcare.2.

Record
CLSA-2026-1792700837
Updated
2026-11-02

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open