Braces
Monthly
Stack exhaustion in the Node.js 'braces' library (micromatch) through 3.0.3 lets unauthenticated remote attackers crash the hosting Node.js process by supplying brace patterns nested deeply enough to overflow the call stack - for example long chains of '{{{{...}}}}' kept just under the library's internal character-length limit, so length-based input validation does not block the payload. Exploitation requires an application path that forwards attacker-controlled strings into braces' recursive AST walkers (the braces(), expand(), or compile() paths referenced at parse.js L38-40, expand.js L102-105, and compile.js L49-53), such as a web parameter or filename routed through micromatch/chokidar-style globbing; the result is an uncaught RangeError that terminates the process. Per the supplied CVSS vector (PR:N/UI:N) no authentication or user interaction is needed on the vulnerable code path, and the CVSS 4.0 score of 8.7 is driven entirely by availability (VA:H) with no confidentiality or integrity impact; no public exploit code was identified at time of analysis.
The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Stack exhaustion in the Node.js 'braces' library (micromatch) through 3.0.3 lets unauthenticated remote attackers crash the hosting Node.js process by supplying brace patterns nested deeply enough to overflow the call stack - for example long chains of '{{{{...}}}}' kept just under the library's internal character-length limit, so length-based input validation does not block the payload. Exploitation requires an application path that forwards attacker-controlled strings into braces' recursive AST walkers (the braces(), expand(), or compile() paths referenced at parse.js L38-40, expand.js L102-105, and compile.js L49-53), such as a web parameter or filename routed through micromatch/chokidar-style globbing; the result is an uncaught RangeError that terminates the process. Per the supplied CVSS vector (PR:N/UI:N) no authentication or user interaction is needed on the vulnerable code path, and the CVSS 4.0 score of 8.7 is driven entirely by availability (VA:H) with no confidentiality or integrity impact; no public exploit code was identified at time of analysis.
The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.