CVE-2025-50537
Medium · 5.5CVSS
5.5
EPSS
0.2%
Published
Jan 26, 2026
CISA due date
—
The record
Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js. The exploit is triggered via the RuleTester.run() method, which validates test cases and checks for duplicates. During validation, the internal function checkDuplicateTestCase() is called, which in turn uses the isSerializable() function for serialization checks. When a circular reference object is passed in, isSerializable() enters infinite recursion, ultimately causing a stack overflow.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | eslint | 0 | 9.26.0 |
| Chainguard | arangodb-3.11 | 0 | 3.11.14.2-r3 |
| Chainguard | argo-workflows-ui-3.6 | 0 | 3.6.18-r0 |
| Chainguard | argo-workflows-ui-3.7 | 0 | 3.7.9-r0 |
| Chainguard | langfuse-2-worker | 0 | 2.95.12-r7 |
| Chainguard | langfuse-fips-2-worker | 0 | 2.95.12-r7 |
| Chainguard | prism | 0 | 5.14.3-r5 |
| Chainguard | vitess-21 | 0 | 21.0.6-r3 |
| Chainguard | vitess-22 | 0 | 22.0.2-r4 |
| Chainguard | vitess-23 | 0 | 23.0.0-r5 |
| Wolfi | argo-workflows-ui-3.7 | 0 | 3.7.9-r0 |
| Wolfi | prism | 0 | 5.14.3-r5 |
| Wolfi | vitess-21 | 0 | 21.0.6-r3 |
| Wolfi | vitess-22 | 0 | 22.0.2-r4 |
| Wolfi | vitess-23 | 0 | 23.0.0-r5 |
Related vulnerabilities
- GHSA-p5wg-g6qr-c7cg Withdrawn Advisory: eslint has a Stack Overflow when serializing objects with circular… Same vulnerability
- GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names Also affects arangodb-3.11
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects arangodb-3.11
- CVE-2026-4800 Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm)… Also affects arangodb-3.11
- CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the… Also affects arangodb-3.11
- CVE-2026-33228 flatted is a circular JSON parser. Also affects arangodb-3.11
- GHSA-rf6f-7fwh-wjgh Prototype Pollution via parse() in NodeJS flatted Also affects arangodb-3.11
- GHSA-25h7-pfq9-p65f flatted vulnerable to unbounded recursion DoS in parse() revive phase Also affects arangodb-3.11