Executive brief
ESLint is a JavaScript code quality and style checking tool used by millions of developers. This vulnerability causes ESLint's rule testing framework to crash when developers test rules that inadvertently contain circular references in test objects, preventing rule validation and potentially disrupting the development workflow.
Technical details
The vulnerability is an infinite recursion flaw (CWE-674) in the isSerializable() function within eslint/lib/shared/serialization.js. When the RuleTester.run() method validates test cases through checkDuplicateTestCase(), it calls isSerializable() to check if objects can be serialized. The function recursively examines object properties without tracking already-visited objects, causing unbounded recursion when circular references are encountered. An attacker or developer can trigger this via the public RuleTester API by passing test case objects containing circular references, resulting in a stack overflow crash. The vulnerability affects versions before 9.26.0, where the issue was patched by adding proper circular reference detection.
Affected products
- ESLint ESLint before 9.26.0
Timeline
- 2026-01-26: disclosed
- 2026-01-26: patched: Fixed in version 9.26.0
- 2026-02-03: other: Advisory withdrawn because RuleTester is used only during development and results in an error rather than crashing the application