Skip to content
OpenAdvisories
Medium · 5.5 CVE-2025-50537 EUVD-2025-206359GHSA-p5wg-g6qr-c7cg

Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.j…

Published Jan 26, 2026 · Updated Jan 26, 2026 · Assigned by mitre

Description

Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js. The exploit is triggered via the RuleTester.run() method, which validates test cases and checks for duplicates. During validation, the internal function checkDuplicateTestCase() is called, which in turn uses the isSerializable() function for serialization checks. When a circular reference object is passed in, isSerializable() enters infinite recursion, ultimately causing a stack overflow.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu 26.10 eslint No fix yet —
Ubuntu 26.04 LTS eslint No fix yet —
Ubuntu 25.10 eslint No fix yet —
Ubuntu 24.04 LTS eslint No fix yet —
Ubuntu 22.04 LTS eslint No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS eslint No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling prism 5.14.3-r5 —
Wolfi rolling vitess-23 23.0.0-r5 —

References