CVE-2023-25166: Regular Expression Denial of Service (ReDoS) Vulnerability
formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
formulato a version that resolves this vulnerability.Fixed in 3.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-25166?
CVE-2023-25166 has a severity that can lead to denial of service due to polynomial execution time vulnerabilities.
How do I fix CVE-2023-25166?
To fix CVE-2023-25166, upgrade to version 3.0.1 or later of the formula library.
What versions are affected by CVE-2023-25166?
CVE-2023-25166 affects versions of the formula library prior to 3.0.1.
Can I use a workaround for CVE-2023-25166?
There are no known workarounds for CVE-2023-25166; upgrading is required to mitigate the issue.
What does CVE-2023-25166 impact?
CVE-2023-25166 impacts the hapi formula library used in Node.js applications.