N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-66453

CVE-2025-66453: Rhino has high CPU usage and potential DoS when passing specific numbers to `toFixed()` function

When an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service.

Small numbers go through this call stack: NativeNumber.numTo > DToA.JS_dtostr > DToA.JS_dtoa > DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power.

Example code: (4.47118444E-314).toFixed(2)

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-66453

CVE-2025-66453:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.mozilla:rhino	maven	< 1.7.14.1	1.7.14.1
org.mozilla:rhino	maven	>= 1.7.15, < 1.7.15.1	1.7.15.1
org.mozilla:rhino	maven	= 1.8.0	1.8.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the way Rhino's toFixed() function handled the conversion of very small floating-point numbers to strings. The advisory explicitly provides the vulnerable call stack: NativeNumber.numTo -> DToA.JS_dtostr -> DToA.JS_dtoa -> DToA.pow5mult. The pow5mult function would enter a long-running loop, consuming significant CPU and causing a denial of service.

The provided patch at commit 2bcf4c43deace35f1f57d86377c6767b0608986e addresses this by completely replacing the vulnerable number formatting logic.

In src/org/mozilla/javascript/NativeNumber.java, the execIdCall method, which dispatches calls to toFixed, toExponential, etc., is modified. The call to the now-removed num_to function for the Id_toFixed case is replaced with a call to a new js_toFixed method. The num_to function was the bridge to the vulnerable DToA library. Its removal for toFixed calls is the core of the fix.

The new implementation in js_toFixed leverages a newly added class, org.mozilla.javascript.dtoa.DecimalFormatter, which uses Java's BigDecimal for number formatting. This avoids the problematic custom DToA implementation for the vulnerable cases.

Therefore, the key vulnerable functions that would appear in a runtime profile during exploitation are org.mozilla.javascript.NativeNumber.num_to and org.mozilla.javascript.DToA.JS_dtostr, as they are the entry points into the vulnerable code path that was removed by the patch.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.