CVE-2026-97058 MEDIUM

CVE-2026-97058: sprintf-js through 1.1.3 Denial of Service via Unbounded Precision

Vendor Alexei

Product sprintf-js

Weakness CWE-1284

Published September 24, 2026

Last update September 24, 2026

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations with minimal payload.

Key dates

02Disclosure timeline

September 24, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-97058 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1284.html AskarLabs — CWE-1284 write-up Improper Validation of Specified Quantity in Input

Related vulnerabilities

04Related CVE

CVE-2026-57364 WordPress Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More plugin <= 2.2.0 - Other Vulnerability Type vulnerability CVE-2024-30516 WordPress Booking Package plugin <= 1.6.27 - Price Manipulation vulnerability CVE-2026-49110 WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.4 - Price Manipulation vulnerability CVE-2026-45441 WordPress WpEvently plugin <= 5.3.3 - Other Vulnerability Type vulnerability CVE-2025-49292 WordPress Profile Builder plugin <= 3.13.8 - Content Spoofing Vulnerability