CVE-2023-39663

7.5 highEPSS 0.8%

High (7.5) in mathjax mathjax. EPSS 0.8% chance of exploitation in the next 30 days.

Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the components pattern and markdownPattern. NOTE: the vendor disputes this because the regular expressions are not applied to user input; thus, there is no risk.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
CWE: CWE-1333
Published: 2023-08-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mathjax:mathjax

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-v638-q856-grg8	npm	mathjax	<=2.7.9	no fix published

References

https://github.com/mathjax/MathJax/issues/3074
https://github.com/mathjax/MathJax/issues/3074

Check your stack JSON