> CVE-2025-50537

« BACK_TO_HOME
PUBLISHED
2026-01-26 16:15
MODIFIED
2026-01-26 16:15
EPSS (Prob. Exploit)
0.20%
Top 90.3%
DATA SOURCES:
NVD 🔗 2026-01-26 RED HAT 🔗 2026-02-01 FIRST EPSS 🔗 2026-11-08 OSV 🔗 2026-11-08

> DESCRIPTION

Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js. The exploit is triggered via the RuleTester.run() method, which validates test cases and checks for duplicates. During validation, the internal function checkDuplicateTestCase() is called, which in turn uses the isSerializable() function for serialization checks. When a circular reference object is passed in, isSerializable() enters infinite recursion, ultimately causing a stack overflow.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY
Moderate

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:
Unknown / Unknown
344 versions affected

> HISTORIQUE DES MODIFICATIONS

Première apparition
26/01/2026 16:15
Source: NVD
📊 ENRICHISSEMENT 01/02/2026 05:01
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
N/A
Nouvelle valeur:
{ "threat_severity": "Moderate", "severity_scale": null }
📊 ENRICHISSEMENT 01/02/2026 05:01
REDHAT
Champ modifié: Red Hat
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 2 Dernière mise à jour: 9 months ago

> REFERENCES

https://gist.github.com/lyyffee/2ee1815e5c2da82c05e9838b9bfefbbc
https://github.com/eslint/eslint/issues/19646
« BACK_TO_HOME