CVE-2023-25166mediumCWE-1333

CVE-2023-25166: medium-severity vulnerability in hapijs formula

Regular Expression Denial of Service (ReDoS) Vulnerability

Published · Updated

Follow this CVE+ Monitor formula+ Monitor @sideway/formula

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.5epss 0.6%
formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
hapijs · formula