Vulnerability in Kap project

[ankitdn]

While working on Kap project, I discovered a Regex Denial of Service (ReDoS) vulnerability CVE-2025-45143 in the string-math npm package (this dependency used by kap). The flaw allows specially crafted input to trigger catastrophic regex backtracking, leading to high CPU usage and potential application crashes.

CVE Link
CVE Report