The sprintf-js library versions up to 1.1.3 improperly validate precision specifiers in format strings. These unbounded precision values are passed to JavaScript's toFixed, toExponential, and toPrecision methods without checks, leading to uncaught RangeError exceptions. An attacker controlling format strings can exploit this by injecting excessively large precision values, causing the calling operations to abort with minimal payload.

This vulnerability can cause application crashes due to uncaught RangeError exceptions when processing maliciously crafted format strings. There is no indication of privilege escalation, data leakage, or remote code execution. The impact is limited to denial of service via application abort.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted format strings or implement input validation to restrict precision specifiers within safe bounds.