Homepage

org.webjars.npm:brace-expansion@2.1.2

  • latest version

    5.0.6

  • first published

    11 years ago

  • latest version published

    2 months ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.webjars.npm:brace-expansion package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Allocation of Resources Without Limits or Throttling

    org.webjars.npm:brace-expansion is a WebJar for brace-expansion.

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the expand() function and its recursive expand_ helper, which cap the number of results via the max option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as {a,b} repeated, keeping the result count under max while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to expand(), directly or transitively through minimatch or glob brace patterns.

    How to fix Allocation of Resources Without Limits or Throttling?

    A fix was pushed into the master branch but not yet published.

    [0,)
    • H
    Inefficient Algorithmic Complexity

    org.webjars.npm:brace-expansion is a WebJar for brace-expansion.

    Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the expand function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The max option does not prevent this issue, as it only limits the output size and not the computational workload.

    How to fix Inefficient Algorithmic Complexity?

    A fix was pushed into the master branch but not yet published.

    [0,)
    • L
    Regular Expression Denial of Service (ReDoS)

    org.webjars.npm:brace-expansion is a WebJar for brace-expansion.

    Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the expand() function, which is prone to catastrophic backtracking on very long malicious inputs.

    How to fix Regular Expression Denial of Service (ReDoS)?

    Upgrade org.webjars.npm:brace-expansion to version 5.0.4 or higher.

    [,5.0.4)
    Go back to all versions of this package