CVE-2026-109149 in js-beautify
Summary
by MITRE • 10/13/2026
A weakness has been identified in beautifier js-beautify up to 1.15.1/2.0.3. The affected element is an unknown function. Executing a manipulation can lead to uncontrolled memory allocation. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The js-beautify library, widely utilized for formatting and prettifying code across various programming languages including JavaScript, HTML, CSS, and others, has been identified with a critical security weakness in versions up to 1.15.1 and 2.0.3. This vulnerability stems from an unknown function within the core processing logic of the library that fails to properly validate or limit input parameters before initiating memory operations. The flaw is categorized under CWE-789, which describes uncontrolled memory allocation, a condition where software allocates more memory than intended based on user-supplied data without adequate bounds checking or size validation. This specific implementation error allows an attacker to trigger excessive resource consumption by supplying crafted inputs that cause the beautifier to allocate disproportionately large amounts of system memory during its parsing and formatting routines.
The operational impact of this vulnerability is significant, particularly in environments where js-beautify is used as part of a web application pipeline or automated build process. Because the attack can be launched remotely, an adversary does not need direct access to the underlying server but only needs to interact with any service that processes untrusted code snippets through the affected version of the library. By sending specially crafted malicious payloads, an attacker can induce a denial-of-service condition by exhausting available memory resources on the target system. This leads to application crashes, increased latency for legitimate users, or complete unavailability of services relying on the beautification functionality. In cloud-native environments or containerized deployments, this resource exhaustion could potentially trigger automatic scaling events or cause node failures if not properly mitigated with resource limits and monitoring alerts.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1496, Resource Hijacking, specifically the sub-technique of CPU or Memory Consumption for Denial of Service. The lack of response from the vendor raises concerns regarding the maintenance status and security support lifecycle of these older versions. Organizations relying on js-beautify must recognize that unpatched systems remain exposed to automated scanning tools and targeted attacks designed to exploit known memory allocation flaws in popular open-source dependencies. The absence of a patch or official mitigation guidance necessitates immediate defensive actions by system administrators and developers who integrate this library into their stacks.
To mitigate the risks associated with this vulnerability, it is strongly recommended that all systems running js-beautify versions up to 1.15.1/2.0.3 be upgraded immediately to a version where the issue has been resolved, provided such a patched release exists in later major or minor updates. If upgrading is not feasible due to compatibility constraints, organizations should implement strict input validation and sanitization layers before passing any untrusted code snippets to the beautifier function. Additionally, deploying runtime application self-protection mechanisms or web application firewalls that can detect anomalous memory usage patterns may help mitigate the impact of such attacks. It is also advisable to review dependency management policies to ensure that third-party libraries are regularly audited against known vulnerability databases and updated promptly when security patches become available.