PatchTheCVEjavascript expression evaluator vulnerabilities and fixes
Recent CVEs affecting javascript expression evaluator, with upgrade or downgrade steps. 2 tracked.
Also searched as: javascriptexpressionevaluator.
javascript expression evaluator has 2 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 1. Most recent: 2025-11-14. Highest priority: CVE-2025-12735 (score 65/100).
- CVE-2025-12735 CRITICAL 9.8 DOWNGRADE UPGRADE The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical
- CVE-2025-13204 HIGH 7.3 MITIGATE npm package `expr-eval` is vulnerable to Prototype Pollution
FAQ
How do I fix javascript expression evaluator vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is javascript expression evaluator being exploited right now?
None of the tracked javascript expression evaluator CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which javascript expression evaluator CVE should I patch first?
CVE-2025-12735 currently ranks highest (65/100): The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical.