CVE-2024-4068: Uncontrolled resource consumption in braces
Summary
CVE-2024-4068: Uncontrolled resource consumption in braces. Affects braces versions < 3.0.3. Fixed in 3.0.3. How to fix ↓
Also tracked for
- node-braces · Debian:11
The same CVE-2024-4068 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The braces package is an NPM package that provides a utility for expanding and generating lists of strings using brace expansion patterns. It is commonly used in JavaScript projects to simplify string manipulation tasks. The package allows users to define patterns containing braces, which are then expanded into a list of strings based on the specified pattern. This vulnerability affects version 3.0.2 of the braces package.
Vulnerability Detail
The braces package fails to limit the number of characters it can handle, leading to uncontrolled resource consumption. Specifically, in the lib/parse.js file, if a malicious user sends "imbalanced braces" as input, the parsing process enters a loop that causes the program to continuously allocate heap memory without freeing it. This can result in memory exhaustion, eventually leading to a crash of the program. The vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
Latest published version: 3.0.3 as of 22 Oct 2026
npm install braces@3.0.3The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the braces package to mitigate the risk of uncontrolled resource consumption.
Conclusion
The braces package is vulnerable to uncontrolled resource consumption, which can lead to memory exhaustion and program crashes. It is crucial to update to version 3.0.3 or later of the package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for braces →
FAQ
The braces package is an NPM package that provides a utility for expanding and generating lists of strings using brace expansion patterns.
This vulnerability can lead to memory exhaustion, causing the program to crash. It can be exploited by sending specially crafted input containing imbalanced braces.
To fix this vulnerability, update the braces package to version 3.0.3 or later using the command npm install braces@latest.
No, there is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
This vulnerability has a CVSS score of 7.5, indicating a high severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for braces.
