CVE-2025-45143: string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS)

June 30, 2025

string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input.

References

gist.github.com/6en6ar/361608bccedb808061359481fe2f1b39
github.com/advisories/GHSA-994j-5c83-r424
github.com/devrafalko/string-math
github.com/devrafalko/string-math/blob/master/string-math.js
nvd.nist.gov/vuln/detail/CVE-2025-45143
www.npmjs.com/package/string-math%2C

Code Behaviors & Features

Detect and mitigate CVE-2025-45143 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →