A weakness in js‑beautify versions up to 1.15.1 and 2.0.3 allows an attacker to trigger uncontrolled memory allocation through an unknown function. Executing a specially crafted input can force the program to allocate an excessive amount of memory, potentially exhausting system resources and causing a denial of service. The vulnerability is described as an uncontrolled memory allocation flaw, which is a type of overflow that can be exploited remotely by any user who can send data to the processing functionality.

The affected product is the beautifier js‑beautify package, implemented by the vendor beautifier. All releases up to and including versions 1.15.1 and 2.0.3 are impacted.

The CVSS base score is 6.9, indicating a moderate severity vulnerability. No EPSS score is available, and the flaw has not been listed in the CISA KEV catalog. The attack can be launched remotely by sending a crafted payload to the js‑beautify processing API or function, and does not require elevated privileges. The lack of an EPSS score means that the exploitation probability could not be quantified, but the remote nature of the attack and the potential for denial of service makes it prudent to address promptly.