GHSA-3w8q-xq97-5j7xLow

Rhino has high CPU usage and potential DoS when passing specific numbers to `toFixed()` function

Published
December 3, 2025
Last Modified
December 4, 2025

🔗 CVE IDs covered (1)

📋 Description

When an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service.

Small numbers go through this call stack: NativeNumber.numTo > DToA.JS_dtostr > DToA.JS_dtoa > DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power.

Example code: (4.47118444E-314).toFixed(2)

🎯 Affected products3

  • maven/org.mozilla:rhino:< 1.7.14.1
  • maven/org.mozilla:rhino:>= 1.7.15, < 1.7.15.1
  • maven/org.mozilla:rhino:= 1.8.0

🔗 References (4)