Listen to this Post
The vulnerability exploits the `DToA` number conversion library within the Mozilla Rhino JavaScript engine. When the `Number.prototype.toFixed()` method is called with a specifically crafted, very small floating-point number (e.g., 4.47118444E-314), the internal conversion process enters an inefficient algorithmic path. The input value triggers a call chain: `NativeNumber.numTo` -> `DToA.JS_dtostr` -> `DToA.JS_dtoa` -> DToA.pow5mult. The `pow5mult` function is designed to compute 5 raised to a given power for generating decimal representations. The maliciously small number results in an excessively large, unrealistic exponent being calculated for this operation. This forces the function to perform billions of iterative multiplications, consuming substantial CPU time and causing the thread to hang. This state of high CPU utilization can lead to a Denial of Service (DoS) condition, as the JavaScript context becomes unresponsive, blocking further execution and exhausting system resources without crashing the process itself.
Platform: mozilla/rhino
Version: <1.7.14.1 >=1.7.15 <1.7.15.1 =1.8.0
Vulnerability : DoS via toFixed()
Severity: Low
date: Dec 3 2025
Prediction: Patched Dec 3 2025
What Undercode Say:
Check if a version is vulnerable grep "version" package.json | grep -E "(1.7.[0-9]|1.8.0)" Example triggering code node -e "console.log((4.47118444E-314).toFixed(2));"
How Exploit:
Attacker passes maliciously small float value (e.g., 4.47118444E-314) to the `toFixed()` method in user-controlled input, causing thread exhaustion and application hang.
Protection from this CVE
Update to patched versions: 1.7.14.1, 1.7.15.1, or 1.8.1. Sanitize numeric input to toFixed().
Impact:
High CPU consumption, application unresponsiveness, potential Denial of Service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
