What’s Vulnerable › Vulnerabilities

CVE-2025-50537

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-26 · updated 2026-06-17
• Weakness: CWE-674

Description

Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js. The exploit is triggered via the RuleTester.run() method, which validates test cases and checks for duplicates. During validation, the internal function checkDuplicateTestCase() is called, which in turn uses the isSerializable() function for serialization checks. When a circular reference object is passed in, isSerializable() enters infinite recursion, ultimately causing a stack overflow.

Affected products

• Openjsf Eslint: before 9.26.0 — fixed in 9.26.0

How to fix

Upgrade to a fixed version: Openjsf Eslint 9.26.0. Check the vendor advisory for mitigations.

References

• https://gist.github.com/lyyffee/2ee1815e5c2da82c05e9838b9bfefbbc
• https://github.com/eslint/eslint/issues/19646

Get alerted when CVE-2025-50537 or the next vulnerability affects your stack