CVE-2023-25166: Inefficient Regular Expression Complexity

February 8, 2023 (updated February 16, 2023)

formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula’s parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.

References

github.com/advisories/GHSA-c2jc-4fpr-4vhg
github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802cd1b41b3fe
github.com/hapijs/formula/security/advisories/GHSA-c2jc-4fpr-4vhg
nvd.nist.gov/vuln/detail/CVE-2023-25166

Code Behaviors & Features

Detect and mitigate CVE-2023-25166 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →