Executive brief
braces is a popular Node.js library used for parsing and expanding brace patterns in strings. A malicious attacker can supply specially crafted input with imbalanced braces that causes the parser to enter an infinite loop, consuming memory until the JavaScript process crashes, resulting in denial of service to any application relying on this library.
Technical details
The vulnerability is an uncontrolled resource consumption issue (CWE-400) in the parse.js module of braces. When processing imbalanced braces, the parser enters an infinite loop in line 308 that continuously allocates heap memory without freeing it. The vulnerability is triggered by providing malicious input containing unbalanced braces to the parsing function, and requires no authentication or special privileges. An attacker can exploit this remotely by supplying crafted input to cause the JavaScript heap limit to be exceeded, resulting in a denial-of-service crash. The vulnerability was fixed in version 3.0.3.
Affected products
- micromatch braces before 3.0.3
Timeline
- 2024-05-14: disclosed
- 2024-05-14: patched: Fix released in version 3.0.3