Memory exhaustion issue in version 3.0.2

[srijit-prox]

Vulnerability Details:

Vulnerability ID: CVE-2024-4068

Vulnerability Source: NVD

CWEs: CWE-1050

Inspector Score: None

Exploit Prediction Scoring System (EPSS): 0.00045

Related Vulnerabilities: None

A security vulnerability (CVE-2024-4068) has been identified in the braces NPM package, version 3.0.2 and below. The package fails to limit the number of characters it can handle, which could lead to memory exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, causing the program to allocate heap memory continuously without freeing it. Eventually, this will lead to the JavaScript heap limit being reached and the program crashing.

[n0099]

Already fixed in 3.0.3: #40