CVE-2023-25166

formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.

CVSS 3.1

6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-28)

CWE

CWE-1333

Published

2023-02-08

Modified

2026-10-28

Record from

the NVD, synced 2026-10-28

Affected

• hapi:formula

Packages (OSV)

References

• https://github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802cd1b41b3fe
• https://github.com/hapijs/formula/security/advisories/GHSA-c2jc-4fpr-4vhg
• https://github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802cd1b41b3fe
• https://github.com/hapijs/formula/security/advisories/GHSA-c2jc-4fpr-4vhg

Check your stackJSON