CVE-2025-45143

Published Jun 30, 2025 CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Description

string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

cpe:2.3:a:devrafalko:string-math:1.2.2:*:*:*:*:node.js:*:*

No data.

No data available yet.

No solution or workaround provided in the CVE record

Source	ID	Title
EUVD	EUVD-2025-19555	string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS)
Github GHSA	GHSA-994j-5c83-r424	string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS)

No CVSS v4.0

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.429% probability within 30 days)

References

Link	Providers
https://gist.github.com/6en6ar/361608bccedb808061359481fe2f1b39
https://github.com/devrafalko/string-math/blob/master/string-math.js
https://www.npmjs.com/package/string-math%2C

History

Type	Values Removed	Values Added
First Time appeared		Devrafalko Devrafalko string-math
CPEs		cpe:2.3:a:devrafalko:string-math:1.2.2:::::node.js::
Vendors & Products		Devrafalko Devrafalko string-math

Type	Values Removed	Values Added
Weaknesses		CWE-1333
Metrics		cvssV3_1 `{'score': 7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input.
References		https://gist.github.com/6en6ar/361608bccedb808061359481fe2f1b39 https://github.com/devrafalko/string-math/blob/master/string-math.js https://www.npmjs.com/package/string-math%2C