GitHub Advisoryadvisory · npm
GHSA-994j-5c83-r424 string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS)
LOW
Official page ↗
- Aliases
- CVE-2025-45143
- Ecosystem
- npm
- Packages
- string-math
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weaknesses
- CWE-1333
- Reviewed
- 2025-06-30
Affected packages
• npm string-math: <= 1.2.2 (no fix yet)
Description
string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input.
Related
Alias · CVE (1)
- CVE-2025-45143 string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input. vulnerability
Weakness · CWE (1)
- CWE-1333 Inefficient Regular Expression Complexity weakness