CVE-2023-25166

Published: Feb 8, 2023Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.

Affected (1)

Products: Hapi: Formula

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Hapi Formula	Before 3.0.1

Related CWEs

Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References (4)

https://github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802cd1b41b3fe

Source: security-advisories@github.com

Patch

https://github.com/hapijs/formula/security/advisories/GHSA-c2jc-4fpr-4vhg

Source: security-advisories@github.com

Vendor Advisory

https://github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802cd1b41b3fe

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/hapijs/formula/security/advisories/GHSA-c2jc-4fpr-4vhg

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.