CVE-2026-97058: sprintf-js Denial of Service via Unbounded Precision Specifiers
Summary
CVE-2026-97058: sprintf-js vulnerable to denial of service through unbounded precision specifiers. Affects sprintf-js versions < 1.1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sprintf-js is a popular JavaScript library used for formatting strings. It allows developers to create formatted output similar to the C language's sprintf function. The library is widely utilized in various applications for its simplicity and flexibility in string manipulation. However, it has a vulnerability that can lead to denial of service due to unbounded precision specifiers.
Vulnerability Detail
The sprintf-js library, up to version 1.1.3, is vulnerable to a denial of service attack caused by unbounded precision specifiers being passed to the toFixed, toExponential, and toPrecision methods without proper validation. This flaw allows attackers to inject precision values that exceed ECMAScript limits, resulting in uncaught RangeError exceptions. If exploited, this vulnerability can cause the application to abort operations, potentially leading to service outages.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can sanitize the format strings used in your application to prevent untrusted input from being passed to the sprintf-js functions. Ensure that any precision specifiers are validated before being used.
Conclusion
The sprintf-js library has a vulnerability that can lead to denial of service due to unbounded precision specifiers. It is crucial to update to version 1.1.4 or later to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround. Monitoring tools like Vulert can help keep your application secure against such vulnerabilities.
See every vulnerability recorded for sprintf-js →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
Versions of sprintf-js from 0.0.0 up to 1.1.3 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected by this vulnerability without any signup.
Exploiting this vulnerability can lead to denial of service, causing the application to crash or become unresponsive, which may affect user experience and service availability.
Yes, you can implement input validation and sanitize format strings to prevent untrusted precision specifiers from being processed by the sprintf-js functions.
