CVE-2016-10707: jQuery

High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days.

jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit.

Affected products

• jQuery jQuery: version 3.0.0 only

Published 2018-01-18. Last modified 2026-06-17.