TI-2023-10628 Aliases CVE-2023-25166 GHSA-c2jc-4fpr-4vhg

Regular expression denial of service (ReDoS) in hapijs formula

LOW 30CWE-1333Published 2023-02-08 · Updated 2025-03-10

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00611 49th percentileScored 2026-11-07

Fix Partial formula (hapijs): 3.0.1@sideway/formula (npm): 3.0.1Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
hapijs	formula	before 3.0.1	3.0.1	Patch available	CNA
—	@sideway/formula (npm)	before 3.0.1	3.0.1	Patch available	GHSA-c2jc-4fpr-4vhg

formula Vendorhapijs Affected before 3.0.1 Fixed in 3.0.1 Patch available CNA
@sideway/formula (npm) Vendor— Affected before 3.0.1 Fixed in 3.0.1 Patch available GHSA-c2jc-4fpr-4vhg

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:hapi:formula::::::node.js::*	before 3.0.1	Vulnerable	@hapi

cpe:2.3:a:hapi:formula:*:*:*:*:*:node.js:*:* Versions before 3.0.1 Vulnerable ·@hapi

Remediation

Fix · CNA formula (hapijs) Fixed in 3.0.1
Fix · GHSA-c2jc-4fpr-4vhg @sideway/formula (npm) Fixed in 3.0.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Migration Toolkit for Virtualization	Affected	No fix yet
OpenShift Developer Tools and Services	Affected	No fix planned: Will not fix

Not affected: 1 product

Red Hat Data Grid 8

Timeline

2026-10-02 Threatist record created from CVE-2023-25166
2026-10-03 Alias added: GHSA-c2jc-4fpr-4vhg

References

Patch 1

https://github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802cd1b41b3fe

Advisory 2

Other 1

https://github.com/hapijs/formula

TI-2026-82752 Quadratic-time parsing in @hapi/content allows denial of service CVSS 3.1HIGH 7.5
TI-2026-82716 Quadratic-time split in joi email rule allows denial of service CVSS 3.1HIGH 7.5
TI-2026-61678 joi before 17.13.8 and 18.2.9 Prototype Pollution via messages CVSS 4.0MEDIUM 6.3
TI-2018-02726 Prototype pollution in @hapi hoek node module CVSS 3.0HIGH 8.8
TI-2026-79747 Regular expression denial of service in @hapi/content disposition parsing CVSS 4.0HIGH 8.7
TI-2026-62455 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate CVSS 4.0HIGH 8.7

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences