Description
formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.
Affected products
hapi: formula
References4
- github.com/hapijs/formula/security/advisories/GHSA-c2jc-4fpr-4v… Vendor Advisory
- github.com/hapijs/formula/security/advisories/GHSA-c2jc-4fpr-4v… Vendor Advisory
- github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802… Patch
- github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802… Patch
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - EPSS — exploit probability
- 1% percentile: 49 · as of 6 November 2026
- CWE
- CWE-1333
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.