Uncontrolled resource consumption in braces

Description

The NPM package braces fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends “imbalanced braces” as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop.

Recommendation

Update the braces package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.0.3
• Patched version(s): 3.0.3

References

• GHSA-grv7-fg5c-xmjg
• devhub.checkmarx.com
• CVE-2024-4068
• CWE-1050
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Open WebUI Uncontrolled Resource Consumption vulnerability - open-webui - CVE-2024-12537
• Open WebUI Uncontrolled Resource Consumption vulnerability - CVE-2024-12534
• DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption - CVE-2026-10691
• Uncontrolled Resource Consumption in firebase - CVE-2020-7765

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

braces