Regular Expression Denial of Service in Micromatch NPM Package

CVE-2024-4067

What is CVE-2024-4067?

The Micromatch NPM package prior to version 4.0.8 is affected by a vulnerability that allows for Regular Expression Denial of Service (ReDoS). The issue lies within the micromatch.braces() function, where the regex pattern .* can enter an extensive backtracking loop when processing maliciously crafted inputs. This leads to excessive resource consumption, effectively causing applications that utilize Micromatch to hang or slow significantly. A fix was merged, but subsequent tests indicate the vulnerability may still persist. Developers are advised to employ safer regex patterns to avoid initiating backtracking during matches.

References