Memory Exhaustion in braces

CVE-2024-4068

What is CVE-2024-4068?

The NPM package 'braces', maintained by Micromatch, exhibits a vulnerability in its character handling capabilities prior to version 3.0.3. This weakness allows a malicious user to exploit the system by sending specially crafted imbalanced brace inputs, which in turn triggers an infinite loop within the parsing function located in 'lib/parse.js'. As the loop executes, the application continuously allocates heap memory without releasing it, ultimately leading to a crash when the allocated memory reaches the JavaScript heap limit. This vulnerability highlights the importance of robust input validation and memory management in software development.

References