string-math Regex Denial-of-Service Vulnerability

A regular expression denial-of-service (ReDoS) vulnerability has been identified in string-math version 1.2.2. This issue arises from a regex pattern that can be exploited by providing a carefully crafted input, such as a long string of null bytes and tabs, which eventually causes the application to crash.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the application to crash.

Reproduction

The vulnerability can be reproduced by using the string-math library and inputting a payload that consists of 5000 tabs followed by 100 instances of '0()'. This crafted input takes advantage of the regex pattern, causing a significant delay before the application crashes.