CVE-2025-50537: 
JavaScript vulnerability analysis and mitigation

CVE-2025-50537 is a stack overflow vulnerability in ESLint's serialization module (eslint/lib/shared/serialization.js) affecting all versions prior to 9.26.0. The flaw was reported on April 22, 2025 by researcher lyyffee and publicly disclosed on January 26, 2026. It affects ESLint (the Node.js linting tool) as well as downstream IBM products including IBM API Connect, IBM watsonx Orchestrate with watsonx Assistant Cartridge, and IBM Instana Observability (OnPrem). It carries a CVSS v3.1 base score of 5.5 (Medium) (ESLint Issue, IBM Advisory).

The root cause is uncontrolled recursion (CWE-674) in the isSerializable() function within eslint/lib/shared/serialization.js. When RuleTester.run() validates test cases, it calls checkDuplicateTestCase(), which invokes isSerializable() to determine whether test case objects can be serialized. The function recursively traverses object properties without any cycle detection; if a test case object contains a circular reference (e.g., obj.self = obj), the function enters infinite recursion, exhausting the call stack and causing a RangeError: Maximum call stack size exceeded. Exploitation requires the attacker to supply a crafted test case object with circular references to the RuleTester.run() method. A proof-of-concept is publicly available (ESLint Issue, PoC Gist).

Successful exploitation results in a Denial of Service (DoS) by crashing the ESLint process with a stack overflow error, rendering the linter unavailable. There is no confidentiality or integrity impact — the vulnerability is limited to availability (CVSS A:H, C:N, I:N). In CI/CD pipelines or development environments where ESLint is invoked automatically, a crash could disrupt build processes or automated code quality checks (ESLint Issue, PoC Gist).

A public proof-of-concept is available via a GitHub Gist published by the original reporter and referenced in the ESLint issue tracker. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), indicating very low probability of exploitation in the near term. Exploitation requires local access and user interaction (supplying crafted input to RuleTester.run()), limiting its practical attack surface (PoC Gist, ESLint Issue).

1. Identify target: Confirm the target environment uses ESLint prior to version 9.26.0 with access to the RuleTester API (e.g., a custom ESLint rule test suite).
2. Craft circular reference object: Create a JavaScript object that references itself, e.g.:

const obj = { a: 1 };
obj.self = obj;

3. Inject into RuleTester: Supply the circular reference object as part of a test case passed to RuleTester.run(), for example as an option or code property in the valid or invalid test arrays.
4. Trigger stack overflow: When RuleTester.run() executes, it calls checkDuplicateTestCase(), which calls isSerializable() on the crafted object. The function recurses infinitely through the circular reference, causing a RangeError: Maximum call stack size exceeded and crashing the ESLint process (ESLint Issue, PoC Gist).

• Logs: Node.js process crash logs containing RangeError: Maximum call stack size exceeded originating from eslint/lib/shared/serialization.js or isSerializable().
• Process: Unexpected termination of the ESLint process or CI/CD pipeline failures attributed to a stack overflow error during rule test execution.
• File System: Presence of unusual or externally supplied ESLint rule test files containing objects with self-referential properties passed to RuleTester.run().

Upgrade ESLint to version 9.26.0 or later, which includes a fix for the uncontrolled recursion in isSerializable(). As a workaround, restrict access to the RuleTester.run() method so that only trusted, internally controlled test cases are processed. IBM has released patches for affected products: IBM API Connect (see nodes 7273320 and 7273485), IBM watsonx Orchestrate with watsonx Assistant Cartridge (nodes 7273279 and 7273280), and IBM Instana Observability OnPrem (IBM Advisory, IBM API Connect, IBM Instana).