5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-50537

CVE-2025-50537: eslint has a Stack Overflow when serializing objects with circular references

Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js. The exploit is triggered via the RuleTester.run() method, which validates test cases and checks for duplicates. During validation, the internal function checkDuplicateTestCase() is called, which in turn uses the isSerializable() function for serialization checks. When a circular reference object is passed in, isSerializable() enters infinite recursion, ultimately causing a stack overflow.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-50537

CVE-2025-50537:

5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
eslint	npm	< 9.26.0	9.26.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stack overflow in eslint caused by uncontrolled recursion when handling objects with circular references. The analysis of the patch d683aebc8e0792e4f80bd1488c705c90f22c317e confirms this.

The primary vulnerable function is isSerializable in lib/shared/serialization.js. Before the patch, this function would recursively traverse an object to check if it was serializable. However, it did not keep track of visited objects. When given an object with a circular reference, it would enter an infinite loop of recursive calls, leading to a stack overflow. The patch fixes this by introducing a seenObjects Set to track visited objects and break the recursion if a cycle is detected.

A second, similar vulnerability was fixed in the freezeDeeply function within lib/rule-tester/rule-tester.js. This function also performed a deep traversal of an object and was susceptible to the same infinite recursion on circular references. The fix is identical, adding a seenObjects set to prevent cycles.

The entry point for triggering this vulnerability is the RuleTester.run method. This method is used to validate test cases for ESLint rules. As part of the validation, it checks for duplicate test cases, which involves serializing the test case objects. If a test case contains an object with a circular reference, it triggers the vulnerable isSerializable function, causing the crash. Therefore, RuleTester.run is a critical function in the exploit chain.

A runtime profile during exploitation would show a deep stack trace of isSerializable calling itself repeatedly, originating from a call to RuleTester.run. Similarly, freezeDeeply could also appear in the stack trace if it's called on a malicious object.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.