hapijs/formula · Security
@sideway/formula contains Regular Expression Denial of Service (ReDoS) Vulnerability
- GHSA ID
- GHSA-c2jc-4fpr-4vhg
- CVE ID
- CVE-2023-25166
- Severity
- medium
- Published
- Updated
- CVSS
- 5.5 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- CVSS v3
- 5.5 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Description
Impact
User-provided strings to formula's parser might lead to polynomial execution time.
Patches
Users should upgrade to 3.0.1+.
Workarounds
None.
CWEs
- CWE-1333 · Inefficient Regular Expression Complexity