PT-2019-20045 · Braces · Braces

Published 2019-06-06 · Updated 2019-06-06

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions braces versions prior to 2.3.1

Description The issue concerns Regular Expression Denial of Service (ReDoS) where untrusted input may cause catastrophic backtracking while matching regular expressions, leading to Denial of Service and causing the application to be unresponsive.

Recommendations Upgrade to version 2.3.1 or higher.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-185

Related Identifiers

GHSA-G95F-P29Q-9XW4

Affected Products

Braces

References · 4

• https://osv.dev/vulnerability/GHSA-g95f-p29q-9xw4 · Vendor Advisory
• https://github.com/micromatch/braces/commit/abdafb0cae1e0c00f184abbadc692f4eaa98f451 · Note
• https://snyk.io/vuln/npm:braces:20180219 · Note
• https://npmjs.com/advisories/786 · Note