---
id: CVE-2026-97058
title: >-
  sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed,
  toExponential, and toPrecision methods without validation, causing uncaught
  RangeError exceptions
summary: >-
  sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed,
  toExponential, and toPrecision methods without validation, causing uncaught
  RangeError exceptions. Attackers who control format strings can inject
  precision value…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-1284
vendor: alexei
product: sprintf-js
affected:
  - sprintf-js <= 1.1.3
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:08:22.573'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97058'
references:
  - url: 'https://github.com/alexei/sprintf.js'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/alexei/sprintf.js/blob/3a0d8c26d291b5bd9f1974877ecc50739921d6f5/src/sprintf.js#L17
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/alexei/sprintf.js/blob/3a0d8c26d291b5bd9f1974877ecc50739921d6f5/src/sprintf.js#L84-L90
    label: disclosure@vulncheck.com
  - url: 'https://github.com/alexei/sprintf.js/issues/237'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/sprintf-js-through-1.1.3-denial-of-service-via-unbounded-precision
    label: disclosure@vulncheck.com
  - url: 'https://github.com/alexei/sprintf.js/issues/237'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-24T14:32:04.411546Z'
ingestedAt: '2026-09-24T14:44:21.327Z'
---

## Overview

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations with minimal payload.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.