CVE-2025-66453: High CPU Usage and Potential DoS in org.mozilla:rhino Due to toFixed() Function
Summary
CVE-2025-66453: Rhino has high CPU usage and potential DoS when passing specific numbers to toFixed() function. Affects org.mozilla:rhino across 3 version ranges.
< 1.7.14.1
>= 1.7.15, < 1.7.15.1
>= 1.8.0, < 1.8.1
Fixed in 1.7.14.1, 1.7.15.1 or 1.8.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rhino is an open-source JavaScript engine developed by Mozilla, primarily used for embedding JavaScript in Java applications. It allows developers to execute JavaScript code within Java applications, providing a bridge between the two languages. Rhino is widely utilized for its ability to integrate scripting capabilities into Java applications, enhancing their functionality. However, a recent vulnerability has been identified that can lead to high CPU usage and potential Denial of Service (DoS) when specific float point numbers are passed to the toFixed() function.
Vulnerability Detail
The vulnerability arises when an attacker controls the input to the toFixed() function, which can lead to excessive CPU consumption. This occurs through a call stack that includes NativeNumber.numTo, DToA.JS_dtostr, DToA.JS_dtoa, and DToA.pow5mult. The pow5mult function attempts to raise 5 to an extremely high power, resulting in high CPU usage. For example, calling (4.47118444E-314).toFixed(2) can trigger this issue, potentially leading to a Denial of Service as the application becomes unresponsive due to resource exhaustion.
How To Fix
Latest published version: 1.9.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.7.14.11.7.14.1 -
>= 1.7.15, < 1.7.15.11.7.15.1 -
>= 1.8.0, < 1.8.11.8.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid passing untrusted or attacker-controlled float point numbers to the toFixed() function. Implement input validation to ensure that only safe and expected values are processed.
Conclusion
The CVE-2025-66453 vulnerability in the org.mozilla:rhino package poses a significant risk of high CPU usage and potential Denial of Service when specific float point numbers are processed. It is crucial to update to the patched versions to safeguard applications against this vulnerability.
See every vulnerability recorded for org.mozilla:rhino →
FAQ
CVE-2025-66453 is a vulnerability in the org.mozilla:rhino package that can lead to high CPU usage and potential Denial of Service when specific float point numbers are passed to the toFixed() function.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can also use the Vulert playground to analyze your pom.xml without any signup.
The primary consequence of this vulnerability is high CPU consumption, which can lead to Denial of Service, making the application unresponsive and affecting user experience.
To update the package, modify your pom.xml file to include a patched version of the org.mozilla:rhino package, such as 1.8.1, and then rebuild your project.
Yes, you can mitigate the risk by implementing input validation to ensure that only safe float point numbers are passed to the toFixed() function.
