braces through 3.0.3 Stack Overflow via Deeply Nested Patterns
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 0.4%
probabilidad de explotación
0.4%top 64% de las CVE
explotación observada
noninguna fuente lo reporta
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
micromatch · bracesReferencias
https://github.com/micromatch/braceshttps://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40https://github.com/micromatch/braces/issues/70https://www.vulncheck.com/advisories/braces-through-3.0.3-stack-overflow-via-deeply-nested-patterns