CVE-2024-4068
The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS probability
- 1.47%
- CWE
- CWE-1050
- Published
- 2024-05-13
- Last modified
- 2026-03-13
Affected products
- micromatch braces
Weakness type
Related vulnerabilities
- CVE-2026-52681 — Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid...
- CVE-2026-71488 — league/commonmark: Quadratic-time denial of service when parsing crafted Markdown
- CVE-2026-4634 — Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters
- CVE-2026-22263 — Suricata http1: quadratic complexity in headers parsing over multiple packets
- CVE-2026-22261 — Suricata eve/alert: http1 xff handling can lead to denial of service
- CVE-2025-48866 — ModSecurity has possible DoS vulnerability in sanitiseArg action
- CVE-2025-47947 — ModSecurity Has Possible DoS Vulnerability
- CVE-2025-32907 — Libsoup: denial of service in server when client requests a large amount of overlapping ranges with range header