CVE-2025-50537: Medium severity npm/eslint vulnerability
Withdrawn Advisory This advisory has been withdrawn because RuleTester is used for testing rules during development and results in a error rather than crashing the application.
Original Description
There is a Stack Overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js. The exploit is triggered via the RuleTester.run() method, which validates test cases and checks for duplicates. During validation, the internal function checkDuplicateTestCase() is called, which in turn uses the isSerializable() function for serialization checks. When a circular reference object is passed in, isSerializable() enters infinite recursion, ultimately causing a Stack Overflow.
Other sources
Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js. The exploit is triggered via the RuleTester.run() method, which validates test cases and checks for duplicates. During validation, the internal function checkDuplicateTestCase() is called, which in turn uses the isSerializable() function for serialization checks. When a circular reference object is passed in, isSerializable() enters infinite recursion, ultimately causing a stack overflow.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-50537?
CVE-2025-50537 is classified as a stack overflow vulnerability but has been withdrawn as it does not crash the application.
How do I fix CVE-2025-50537?
To remediate CVE-2025-50537, update eslint to version 9.26.0 or later.
What software is affected by CVE-2025-50537?
CVE-2025-50537 affects all versions of eslint prior to 9.26.0.
What are the implications of CVE-2025-50537?
The implications of CVE-2025-50537 involve potential stack overflow errors during the serialization of objects.
Is CVE-2025-50537 still a concern?
CVE-2025-50537 is no longer a concern since the advisory has been withdrawn, indicating no critical impact.