CVE-2025-66453
Last modified
CVE-2025-66453 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. Small numbers go through this call stack: NativeNumber.numTo > DToA.JS_dtostr > DToA.JS_dtoa > DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Rhino | < 1.7.14.1 |
| Mozilla | Rhino | 1.7.15 |
| Mozilla | Rhino | 1.8.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-66453?
How severe is CVE-2025-66453?
How do I fix CVE-2025-66453?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-66448vLLM is an inference and serving engine for large language m…8.8
- CVE-2025-66449ConvertXis a self-hosted online file converter. In versions …8.8
- CVE-2025-6645PDF-XChange Editor U3D File Parsing Use-After-Free Remote Co…7.8
- CVE-2025-66450LibreChat is a ChatGPT clone with additional features. In ve…5.4
- CVE-2025-66451LibreChat is a ChatGPT clone with additional features. In ve…6.5
- CVE-2025-66452LibreChat is a ChatGPT clone with additional features. In ve…6.1
- CVE-2025-66454Arcade MCP allows you to to create, deploy, and share MCP Se…6.5
- CVE-2025-66456Elysia is a Typescript framework for request validation, typ…9.8
- CVE-2025-66457Elysia is a Typescript framework for request validation, typ…8.8
- CVE-2025-66458Lookyloo is a web interface that allows users to capture a w…6.1
- CVE-2025-66459Lookyloo is a web interface that allows users to capture a w…6.1
- CVE-2025-6646PDF-XChange Editor U3D File Parsing Use-After-Free Informati…3.3
Are you affected by CVE-2025-66453?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST