formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formulas parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.
Weakness
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Formula | Hapi | * | 3.0.1 (excluding) |
Potential Mitigations
Related Attack Patterns
References
- https://github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802cd1b41b3fe
- https://github.com/hapijs/formula/security/advisories/GHSA-c2jc-4fpr-4vhg
- https://github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802cd1b41b3fe
- https://github.com/hapijs/formula/security/advisories/GHSA-c2jc-4fpr-4vhg