Description
The NPM package braces fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends “imbalanced braces” as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop.
Recommendation
Update the braces package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.0.3
- Patched version(s): 3.0.3
References
Could your website be exposed too?
SmartScanner can check your website for Uncontrolled resource consumption in braces and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Open WebUI Uncontrolled Resource Consumption vulnerability - open-webui - CVE-2024-12537
- Open WebUI Uncontrolled Resource Consumption vulnerability - CVE-2024-12534
- DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption - CVE-2026-10691
- Uncontrolled Resource Consumption in firebase - CVE-2020-7765
You might also like:
See something that needs correcting? Let us knowUpdated July 05, 2024