{"id":"EUVD-2023-0685","enisaUuid":"680f659e-e3bd-3668-bf47-f213832586bf","description":"formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula\u0027s parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.","datePublished":"Feb 8, 2023, 7:28:29 PM","dateUpdated":"Mar 10, 2025, 9:14:39 PM","baseScore":5.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","references":"https://github.com/hapijs/formula/security/advisories/GHSA-c2jc-4fpr-4vhg\nhttps://github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802cd1b41b3fe\n","aliases":"CVE-2023-25166\nGHSA-c2jc-4fpr-4vhg\n","assigner":"GitHub_M","epss":0.61,"enisaIdProduct":[{"id":"abb3177b-22c5-3a71-953f-cd92babec832","product":{"name":"formula","vendor":{"name":"awordpresslife"}},"product_version":"\u003c 3.0.1"}],"enisaIdVendor":[{"id":"63760db2-d2f5-313b-a4ea-05b4f8cf7bbb","vendor":{"name":"hapijs"}}],"enisaIdVulnerability":[{"id":"862c4d70-ae62-3f9a-80db-9dbcb3cb1414","vulnerability":{"id":"GHSA-c2jc-4fpr-4vhg","description":"@sideway/formula contains Regular Expression Denial of Service (ReDoS) Vulnerability","datePublished":"Feb 8, 2023, 10:38:10 PM","dateUpdated":"Feb 8, 2023, 10:38:10 PM","baseScore":null,"references":"https://github.com/hapijs/formula/security/advisories/GHSA-c2jc-4fpr-4vhg\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-25166\nhttps://github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802cd1b41b3fe\nhttps://github.com/hapijs/formula\n","enisa_id":"EUVD-2023-0685\n","aliases":"CVE-2023-25166\nGHSA-c2jc-4fpr-4vhg\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:06:16 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"92b21ca6-ca38-3925-bb98-a214c20b3862","vulnerability":{"id":"CVE-2023-25166","description":"formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula\u0027s parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.","datePublished":"Feb 8, 2023, 7:28:29 PM","dateUpdated":"Mar 10, 2025, 9:14:39 PM","status":"PUBLISHED","baseScore":5.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","references":"https://github.com/hapijs/formula/security/advisories/GHSA-c2jc-4fpr-4vhg\nhttps://github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802cd1b41b3fe\n","enisa_id":"EUVD-2023-0685\n","assigner":"GitHub_M","epss":0.61,"dataProcessed":"Nov 1, 2026, 7:19:17 AM","vulnerabilityProduct":[{"id":"0e07cca0-1080-41c4-941b-e16ddb094bee","product":{"name":"formula","vendor":{"name":"awordpresslife"}},"product_version":"\u003c 3.0.1"},{"id":"99a47e42-8780-3e44-8bf3-12c584f175e1","product":{"name":"formula","vendor":{"name":"awordpresslife"}},"product_version":"\u003c 3.0.1"}],"vulnerabilityVendor":[{"id":"bb41637c-cae8-3036-aa98-b2bd70a0b278","vendor":{"name":"hapijs"}}]}}],"enisaIdAdvisory":[]}