Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-50537

21
FAUCET Score

CVE-2025-50537 is a stack overflow vulnerability affecting openjsf eslint versions prior to 9.26.0. It occurs when serializing objects with circular references via the RuleTester.run() method, leading to infinite recursion in the isSerializable() function. Rated Medium with a CVSS score of 5.5, this vulnerability requires user interaction (UI:R) and local access (AV:L), resulting in a denial of service (A:H) due to the stack overflow. There is currently no evidence of active exploitation, no public exploit code (Metasploit, Nuclei, ExploitDB), and minimal community discussion, with only one mention.

Impacted Technologies

VendorProductVersion(s)CPE
< 9.26.0CPE matchmatch criteria
cpe:2.3:a:openjsf:eslint:*:*:*:*:*:node.js:*:*

CVSS Data

CVSS version used by this source: 3.1

5.5MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
1.8
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.16%
Probability of exploitation in next 30 days
EPSS Percentile
5.9%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0016 is in the 8th percentile among its peer group of 5,765 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (60)

npmpatch availablevia ghsa
Product: eslintFixed in: 9.26.0
redhatvendor investigatingvia redhat_api
Product: Cryostat 4Fixed in: io.cryostat-cryostat
redhatvendor investigatingvia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/elasticsearch6-rhel9
redhatvendor investigatingvia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/elasticsearch-operator-bundle
redhatvendor investigatingvia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/elasticsearch-proxy-rhel9
redhatvendor investigatingvia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/elasticsearch-rhel9-operator
redhatvendor investigatingvia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/kibana6-rhel8
redhatvendor investigatingvia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/logging-curator5-rhel9
redhatvendor investigatingvia redhat_api
Product: Multicluster Engine for KubernetesFixed in: multicluster-engine/console-mce-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift PipelinesFixed in: openshift-pipelines/pipelines-console-plugin-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift PipelinesFixed in: openshift-pipelines/pipelines-hub-api-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift PipelinesFixed in: openshift-pipelines/pipelines-hub-db-migration-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift PipelinesFixed in: openshift-pipelines/pipelines-hub-ui-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift PipelinesFixed in: openshift-pipelines/pipelines-hub-ui-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Advanced Cluster Management for Kubernetes 2Fixed in: rhacm2/console-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat AMQ Broker 7Fixed in: org.jolokia-jolokia-parent
redhatvendor investigatingvia redhat_api
Product: Red Hat build of Apicurio Registry 2Fixed in: io.apicurio-apicurio-registry
redhatvendor investigatingvia redhat_api
Product: Red Hat build of OptaPlanner 8Fixed in: org.optaweb.vehiclerouting-optaweb-vehicle-routing
redhatvendor investigatingvia redhat_api
Product: Red Hat Data Grid 8Fixed in: org.infinispan-infinispan-console
redhatvendor investigatingvia redhat_api
Product: Red Hat Directory Server 11Fixed in: redhat-ds:11/389-ds-base
redhatvendor investigatingvia redhat_api
Product: Red Hat Directory Server 12Fixed in: redhat-ds:12/389-ds-base
redhatvendor investigatingvia redhat_api
Product: Red Hat Directory Server 13Fixed in: 389-ds-base
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: firefox
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: grafana
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: js-d3-flame-graph
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: pcs
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: rust
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: thunderbird
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: firefox
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: firefox
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: grafana
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: js-d3-flame-graph
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: pcs
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: thunderbird
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: firefox
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: grafana
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: js-d3-flame-graph
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: pcs
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: rust
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: thunderbird
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI) 3Fixed in: rhelai3/bootc-cuda-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI) 3Fixed in: rhelai3/disk-image-cuda-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: io.syndesis-syndesis-parent
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: org.keycloak-keycloak-parent
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: org.keycloak-keycloak-parent
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-dashboard-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-dashboard-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-agent-installer-ui-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-console
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-console-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/dashboard-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/openvsx-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift distributed tracing 3Fixed in: rhosdt/tempo-jaeger-query-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat Process Automation 7Fixed in: org.kie-process-migration-service
redhatvendor investigatingvia redhat_api
Product: Red Hat Process Automation 7Fixed in: org.kie.workbench-kie-wb-common
redhatvendor investigatingvia redhat_api
Product: Red Hat Process Automation 7Fixed in: org.uberfire-uberfire-parent
redhatvendor investigatingvia redhat_api
Product: Red Hat Quay 3Fixed in: quay/quay-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat Single Sign-On 7Fixed in: org.keycloak-keycloak-parent
redhatvendor investigatingvia redhat_api
Product: streams for Apache Kafka 2Fixed in: com.github.streamshub-console
redhatvendor investigatingvia redhat_api
Product: streams for Apache Kafka 3Fixed in: com.github.streamshub-console

Vendor Advisories (2)

npmGHSA-p5wg-g6qr-c7cgmedium

Withdrawn Advisory: eslint has a Stack Overflow when serializing objects with circular references

Jan 26, 2026
redhatCVE-2025-50537Moderate

eslint: eslint: Denial of Service via stack overflow when serializing objects with circular references

Jan 26, 2026

References

gist.github.com / lyyffee/2ee1815e5c2da82c05e9838b9bfefbbc
Third Party Advisory
github.com / eslint/eslint/issues/19646
ExploitIssue TrackingThird Party Advisory