CVE-2025-66453: Rhino vulnerable high CPU usage and potential DoS when passing specific numbers to toFixed() function
Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. Small numbers go through this call stack: NativeNumber.numTo > DToA.JSdtostr > DToA.JSdtoa > DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1.
Other sources
When an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service.
Small numbers go through this call stack: NativeNumber.numTo > DToA.JSdtostr > DToA.JSdtoa > DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power.
Example code: (4.47118444E-314).toFixed(2)
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66453?
CVE-2025-66453 has a high severity rating due to its potential to cause Denial of Service through excessive CPU consumption.
How do I fix CVE-2025-66453?
To resolve CVE-2025-66453, upgrade the affected 'org.mozilla:rhino' package to version 1.8.1 or higher.
What versions are affected by CVE-2025-66453?
CVE-2025-66453 affects 'org.mozilla:rhino' versions 1.8.0 and 1.7.15, including earlier versions.
What could an attacker achieve with CVE-2025-66453?
An attacker could exploit CVE-2025-66453 to induce high CPU usage, potentially leading to service unavailability.
Is CVE-2025-66453 specific to any software products?
Yes, CVE-2025-66453 specifically impacts software that utilizes the 'org.mozilla:rhino' package.