CVE-2025-66453 Rhino vulnerable high CPU usage and potential DoS when passing specific numbers to toFixed() function
Attackers can cause high CPU usage and denial of service by passing specific floating-point numbers to the toFixed() function in the Rhino JavaScript engine.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-66453?
CVE-2025-66453 is a medium-severity denial of service vulnerability in mozilla rhino, published on 3 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. Small numbers go through this call stack: NativeNumber.numTo > DToA.JS_dtostr > DToA.JS_dtoa > DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1.
Weakness: CWE-400
Which versions are affected by CVE-2025-66453?
6 open source packages ship an affected version, including org.mozilla:rhino. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.mozilla:rhino Maven | All versions | 1.7.14.1 |
org.mozilla:rhino Maven | All versions | 1.7.14.1 |
org.mozilla:rhino Maven | From 1.7.15 | 1.7.15.1 |
org.mozilla:rhino Maven | From 1.7.15 | 1.7.15.1 |
org.mozilla:rhino Maven | From 1.8.0 | 1.8.1 |
org.mozilla:rhino Maven | From 1.8.0 | 1.8.1 |
Linux distribution packages (7)
rhino SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 1.7.15.1-150200.12.7.1 |
rhino SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.7.15.1-150200.12.7.1 |
rhino SUSE:Linux Enterprise Server 16.0 | All versions | 1.7.15.1-160000.1.1 |
rhino SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 1.7.15.1-160000.1.1 |
rhino openSUSE:Leap 15.6 | All versions | 1.7.15.1-150200.12.7.1 |
rhino openSUSE:Leap 16.0 | All versions | 1.7.15.1-160000.1.1 |
rhino openSUSE:Tumbleweed | All versions | 1.7.15.1-1.1 |
Products include Mozilla Rhino.
How do I fix CVE-2025-66453?
Upgrade org.mozilla:rhino to a fixed version for your release line: 1.7.14.1, 1.7.15.1 or 1.8.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-66453 being exploited?
There is no known exploitation of CVE-2025-66453 in the wild and no public exploit code.
Sources
Also known as AZL-71221, AZL-71503, CLSA-2026-1771459787, CLSA-2026-1771546195, DEBIAN-CVE-2025-66453, GHSA-3w8q-xq97-5j7x and 5 more.