js-beautify EUVD-2026-98411

Exploitation requires that the embedding application pass attacker-controlled input (JavaScript/CSS/HTML source) into js-beautify's beautification routines and expose that path to untrusted/remote callers - js-beautify is a library, so it is only remotely reachable when wrapped in a network-facing service such as a web-based formatter or API. No authentication or user interaction is needed per PR:N/UI:N. Limiting factors: impact is confined to availability (memory exhaustion / DoS) with no confidentiality or integrity effect; applications that only beautify trusted/first-party code, or that impose input-size/memory limits, are not meaningfully exposed. Affected versions are stated as js-beautify up to 1.15.1 (1.x) and 2.0.3 (2.x).

This is a moderate-severity availability issue, not a high-priority emergency. The input CVSS 4.0 base score is 6.9 with a vector of AV:N/AC:L/PR:N/UI:N and impact limited strictly to availability (VA:L; VC:N/VI:N), consistent with CWE-789 (uncontrolled memory allocation) - i.e. a denial-of-service via memory exhaustion rather than code execution or data theft. The vector's E:P (Proof-of-Concept) exploit maturity signals that exploit/trigger code exists, so publicly available exploit code likely exists, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation. The signals are internally consistent (remote, low-complexity, unauthenticated, but low technical impact) rather than conflicting. The most important caveat: the AV:N / PR:N / 'attack may be launched remotely' framing assumes the host application feeds attacker-controlled input into js-beautify and exposes it over the network - js-beautify is a code-formatting library, not a network service, so real-world reachability is entirely dependent on how the embedding application uses it. The sole source is VulDB and the vendor did not respond, so affected-version and root-cause details are low-confidence. Net: a genuine but low-urgency DoS best handled via routine patching, not out-of-band response.

An application exposes js-beautify (e.g. an online code formatter or an API that beautifies user-submitted JavaScript/CSS/HTML) to untrusted input. An attacker submits a specially crafted payload that drives uncontrolled memory allocation inside the beautifier, exhausting process memory and causing a denial of service for the hosting service. A proof-of-concept trigger is indicated by the CVSS E:P (Proof-of-Concept) maturity flag.