Go to packages list

braces

Ecosystem: npm

Downloads:

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 2HighAffects 2 versions
  • 0MediumAffects 0 versions
  • 0ModerateAffects 0 versions
  • 2LowAffects 2 versions
Severity distribution (all time)
4vulnerabilities
  • Critical0 (0.0%)
  • High2 (50.0%)
  • Medium0 (0.0%)
  • Moderate0 (0.0%)
  • Low2 (50.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 0
    • Low: 1
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 0
    • Low: 1

Vulnerabilities (4)

Known vulnerabilities affecting braces, based on data from OSV.

Vulnerabilities affecting braces
IDSeveritySummaryAffected versionsPublishedSource
GHSA-vfj7-8cjw-p6xmHighWithdrawn Advisory: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns### Withdrawn Advisory This advisory has been withdrawn because it's not a practically exploitable vulnerability. This link is maintained to preserve external references. ### Original Description braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
  • <= 3.0.3
GitHub (opens in a new tab)
GHSA-grv7-fg5c-xmjgHighUncontrolled resource consumption in bracesThe NPM package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
  • < 3.0.3
GitHub (opens in a new tab)
GHSA-cwfw-4gq5-mrqxLowRegular Expression Denial of Service (ReDoS) in bracesA vulnerability was found in Braces versions from v2.2.0 up to but not including v2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks. This has been patched in version 2.3.1.
  • >= 2.2.0, < 2.3.1
GitHub (opens in a new tab)
GHSA-g95f-p29q-9xw4LowDuplicate Advisory: Regular Expression Denial of Service in braces## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cwfw-4gq5-mrqx. This link is maintained to preserve external references. ## Original Description Versions of `braces` prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service. ## Recommendation Upgrade to version 2.3.1 or higher.
  • < 2.3.1
GitHub (opens in a new tab)
  • GHSA-vfj7-8cjw-p6xmHigh
    Withdrawn Advisory: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns
    • <= 3.0.3
    GitHub (opens in a new tab)

    ### Withdrawn Advisory This advisory has been withdrawn because it's not a practically exploitable vulnerability. This link is maintained to preserve external references. ### Original Description braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

    CVE: CVE-2026-93687

  • GHSA-grv7-fg5c-xmjgHigh
    Uncontrolled resource consumption in braces
    • < 3.0.3
    GitHub (opens in a new tab)

    The NPM package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.

    CVE: CVE-2024-4068

  • GHSA-cwfw-4gq5-mrqxLow
    Regular Expression Denial of Service (ReDoS) in braces
    • >= 2.2.0, < 2.3.1
    GitHub (opens in a new tab)

    A vulnerability was found in Braces versions from v2.2.0 up to but not including v2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks. This has been patched in version 2.3.1.

    CVE: CVE-2018-1109

  • GHSA-g95f-p29q-9xw4Low
    Duplicate Advisory: Regular Expression Denial of Service in braces
    • < 2.3.1
    GitHub (opens in a new tab)

    ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cwfw-4gq5-mrqx. This link is maintained to preserve external references. ## Original Description Versions of `braces` prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service. ## Recommendation Upgrade to version 2.3.1 or higher.

Showing 1-4 of 4 vulnerabilities