We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-40897

CVE-2026-40897

Node.jsExpress

Severity: HIGH
CVSS: 8.8CVSS
Published: 2026-04-24
Last modified: 2026-04-24
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-915

Description

Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser. This vulnerability is fixed in 15.2.0.

References

https://github.com/josdejong/mathjs/commit/513ab2a0e01004af91b31aada68fae8a821326ad
https://github.com/josdejong/mathjs/pull/3656
https://github.com/josdejong/mathjs/security/advisories/GHSA-29qv-4j9f-fjw5

Summary

Description

References