string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS)

높음 7.0CVE-2025-45143 · GHSA-994j-5c83-r424 · Published 30/06/2025 · updated 17/06/2026

요약

CVE-2025-45143은(는) string-math (devrafalko), string-math에 영향을 주는 높음 (CVSS 7.0) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.43%, 전체 취약점의 37.4%보다 높음.
아직 패치 버전 정보가 없습니다. 참고 자료의 공급업체 권고를 확인하세요.

Package	Affected versions	Patched versions
string-math devrafalko	`= 1.2.2`	No fix yet
string-math npm	`≤ 1.2.2`	No fix yet

string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input.

NVD description

string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.