Braces

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:jonschlinkert:braces:*:*:*:*:*:node.js:*:*

part: a version: * update: *

VendorJonschlinkert (ddae82b9-e2e5-5c5d-a403-dbc01aba5aef)
ProductBraces (c16eebbd-acf1-51b3-8c1a-95eddf8ffc5a)
Edition*
Language*
Software edition*
Target softwarenode.js
Target hardware*
Other*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-93687 vulnerable 2026-10-13 12:28:56.109907 braces through 3.0.3 Stack Overflow via Deeply Nested Patterns
HIGH (7.5)
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
Published: 2026-09-18T15:06:02.880Z
Updated: 2026-11-05T14:42:54.668Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-4068 vulnerable 2026-06-08 06:50:16.960261 Memory Exhaustion in braces
HIGH (7.5)
The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Published: 2024-05-13T10:06:38.152Z
Updated: 2024-11-06T13:10:11.179Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.