CVE-2025-50537: openjsf eslint Uncontrolled Recursion

Vulnerability summary

CVE-2025-50537 is a medium (CVSS 5.5) Uncontrolled Recursion vulnerability in openjsf eslint. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 8.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 26-01-2026
   PublishedVulnerability first disclosed.
2. 26-01-2026
   Last modifiedVulnerability information updated.

Description

Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js. The exploit is triggered via the RuleTester.run() method, which validates test cases and checks for duplicates. During validation, the internal function checkDuplicateTestCase() is called, which in turn uses the isSerializable() function for serialization checks. When a circular reference object is passed in, isSerializable() enters infinite recursion, ultimately causing a stack overflow.

• CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.