EIQ-2019-0010

EIQ-2019-0010

-

braces is vulnerable to regular expression denial of service

08 Mar 2019

1 - LOW

CVSSv3 score not available on NIST NVD.

2.5.0

braces Node.js module versions 2.3.0 and earlier are vulnerable to regular expression denial of service (ReDoS).
A regular expression (^\{(,+(?:(\{,+\})*),*|,*(?:(\{,+\})*),+)\}) can be used to detect empty braces.
This can result in a denial of service (CPU consumption).

Update to braces version 2.3.1 or later.

2.2.1 to 2.4.0 included.

For more information, see:

• npm braces advisory

• snyk report

• GitHub issue

• GitHub commit with the fix