CVE-2025-50537

Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js. The exploit is triggered via the RuleTester.run() method, which validates test cases and checks for duplicates. During validation, the internal function checkDuplicateTestCase() is called, which in turn uses the isSerializable() function for serialization checks. When a circular reference object is passed in, isSerializable() enters infinite recursion, ultimately causing a stack overflow.

• CWE-674

• https://gist.github.com/lyyffee/2ee1815e5c2da82c05e9838b9bfefbbcThird Party Advisory
• https://github.com/eslint/eslint/issues/19646Exploit, Issue Tracking, Third Party Advisory

Published

Jan 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-50515An issue was discovered in phome Empirebak 2010 in ebak2008/…6.5
• CVE-2025-50518A use-after-free vulnerability exists in the coap_delete_pdu…9.8
• CVE-2025-5052A vulnerability classified as critical was found in FreeFloa…9.8
• CVE-2025-50526Netgear EX8000 V1.0.0.126 was discovered to contain a comman…9.8
• CVE-2025-50528A buffer overflow vulnerability exists in the fromNatStaticS…7.3
• CVE-2025-5053A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-50538Flowise before 3.0.5 allows XSS via an IFRAME element when a…6.1
• CVE-2025-5054Race condition in Canonical apport up to and including 2.32.…4.7
• CVE-2025-5055The Smart Forms – when you need more than just a contact for…4.4
• CVE-2025-5056A vulnerability was found in Campcodes Online Shopping Porta…9.8
• CVE-2025-50565Doubo ERP 1.0 has an SQL injection vulnerability due to a la…6.5
• CVE-2025-50567Saurus CMS Community Edition 4.7.1 contains a vulnerability …10