What’s Vulnerable › Vulnerabilities

CVE-2024-4068: Memory Exhaustion in braces

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-05-14 · updated 2026-06-17
• Weakness: CWE-1050

Description

The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.

Affected products

• micromatch braces: before 3.0.3 — fixed in 3.0.3
• Npm Braces: before 3.0.3 — fixed in 3.0.3

How to fix

Upgrade to a fixed version: micromatch braces 3.0.3; Npm Braces 3.0.3. Check the vendor advisory for mitigations.

References

• https://devhub.checkmarx.com/cve-details/CVE-2024-4068/
• https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff
• https://github.com/micromatch/braces/issues/35
• https://github.com/micromatch/braces/pull/37
• https://github.com/micromatch/braces/pull/40
• https://devhub.checkmarx.com/cve-details/CVE-2024-4068/
• https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff
• https://github.com/micromatch/braces/issues/35
• https://github.com/micromatch/braces/pull/37
• https://github.com/micromatch/braces/pull/40

Get alerted when CVE-2024-4068 or the next vulnerability affects your stack