Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sprintf-js | npm | <= 1.1.3 |
Miggo AIRoot Cause AnalysisThe vulnerability in sprintf-js (CVE-2026-97058) stems from the lack of input validation on precision specifiers provided in format strings. Specifically, when formatting numbers using 'e' (toExponential), 'f' (toFixed), or 'g' (toPrecision) type specifiers, the sprintf_format function directly uses the ph.precision value extracted from the user-controlled format string. If an attacker provides a very large integer for this precision, the underlying JavaScript Number.prototype.toExponential(), Number.prototype.toFixed(), or Number.prototype.toPrecision() methods will throw a RangeError exception, as these methods have internal limits on the precision argument (typically 0-100). This uncaught exception can lead to a Denial of Service for the application using sprintf-js. The sprintf and vsprintf functions are the public entry points that process the format strings and arguments, ultimately calling sprintf_format where the vulnerable operation occurs. The evidence for this is found in the src/sprintf.js file, where the switch (ph.type) block within sprintf_format directly passes ph.precision to these methods without any bounds checking.
sprintf_formatsrc/sprintf.js
sprintfsrc/sprintf.js
vsprintfsrc/sprintf.js