@sideway/formula contains Regular Expression Denial of Service (ReDoS) Vulnerability · CVE-2023-25166 · GitHub Advisory Database · GitHub

@sideway/formula contains Regular Expression Denial of Service (ReDoS) Vulnerability

Moderate severity GitHub Reviewed Published Feb 8, 2023 in hapijs/formula

Package

@sideway/formula (npm)

Affected versions

< 3.0.1

Patched versions

3.0.1

Description

Impact

User-provided strings to formula's parser might lead to polynomial execution time.

Patches

Users should upgrade to 3.0.1+.

Workarounds

None.

References

Marsup published to hapijs/formula

Feb 8, 2023

Published by the National Vulnerability Database

Feb 8, 2023

Published to the GitHub Advisory Database Feb 8, 2023

Reviewed Feb 8, 2023

Severity

Moderate

5.5

/ 10

CVSS base metrics

Attack vector

Local

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H