CVE-2026-109149

5.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-400, CWE-789

Impact

Remote, unauthenticated attackers can trigger uncontrolled memory allocation to crash or hang services running js-beautify. Exploitation requires sending crafted input to an exposed beautifier endpoint or worker.

Root cause

An unknown function improperly handles input, causing uncontrolled memory consumption (memory allocation with excessive size).

Affected systems

js-beautify up to 1.15.1 and 2.0.3

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Fix & remediation

No fixed version or vendor patch is currently available. Isolate the beautifier behind strict payload size limits or limit untrusted input to js-beautify until upstream releases a fix.

shell

$ npm list js-beautify

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A weakness has been identified in beautifier js-beautify up to 1.15.1/2.0.3. The affected element is an unknown function. Executing a manipulation can lead to uncontrolled memory allocation. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109149