CVE-2024-4068

The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.

Affected products

Alt Linux, Bitbucket, Debian, Red Os, Suse, Braces

Jonschlinkert Braces

< 3.0.3

Fix

Available

CVSS 3.1

7.5 HIGH

EPSS

1.5% (71th percentile)

Weakness

CWE-1050, CWE-400

NVD status

Analyzed

Published

2024-05-13

No exploit for CVE-2024-4068 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.