org.webjars.npm:brace-expansion 5.0.6

Direct Vulnerabilities

Known vulnerabilities in the org.webjars.npm:brace-expansion package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Allocation of Resources Without Limits or Throttling org.webjars.npm:brace-expansion is a WebJar for brace-expansion. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.webjars.npm:brace-expansion` to version 5.0.9 or higher.	[,5.0.9)
H Allocation of Resources Without Limits or Throttling org.webjars.npm:brace-expansion is a WebJar for brace-expansion. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.webjars.npm:brace-expansion` to version 5.0.9 or higher.	[,5.0.9)
H Inefficient Algorithmic Complexity org.webjars.npm:brace-expansion is a WebJar for brace-expansion. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload. How to fix Inefficient Algorithmic Complexity? Upgrade `org.webjars.npm:brace-expansion` to version 5.0.9 or higher.	[,5.0.9)

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling

org.webjars.npm:brace-expansion is a WebJar for brace-expansion.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the expand(), expand_(), combine(), and expandSequence() functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent maxLength allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores maxLength and does work proportional to max * width. Exploitation requires the application to pass untrusted input to expand(), directly or transitively through a glob or pattern-matching library.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade org.webjars.npm:brace-expansion to version 5.0.9 or higher.

[,5.0.9)

Allocation of Resources Without Limits or Throttling

org.webjars.npm:brace-expansion is a WebJar for brace-expansion.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the expand() function and its recursive expand_ helper, which cap the number of results via the max option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as {a,b} repeated, keeping the result count under max while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to expand(), directly or transitively through minimatch or glob brace patterns.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade org.webjars.npm:brace-expansion to version 5.0.9 or higher.

[,5.0.9)

Inefficient Algorithmic Complexity

org.webjars.npm:brace-expansion is a WebJar for brace-expansion.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the expand function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The max option does not prevent this issue, as it only limits the output size and not the computational workload.

How to fix Inefficient Algorithmic Complexity?

Upgrade org.webjars.npm:brace-expansion to version 5.0.9 or higher.

[,5.0.9)

org.webjars.npm:brace-expansion@5.0.6

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically