CVE-2024-4068
High
Description
The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
SeverityHigh
CVSS7.5
Exploit probability—
ProductJonschlinkert Braces
PublishedMay 14, 2024
First seenMay 14, 2024
Weakness typeCWE-1050CWE-1050
How to fix
Update
- jonschlinkert braces3.0.3 or later
- braces3.0.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jonschlinkert braces | v < 3.0.3 | 3.0.3 |
| bracesnpm | v < 3.0.3 | 3.0.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.