Description
The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| micromatch | braces | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-braces | 3.0.3+~3.0.4-1 | — |
| Debian 13 | node-braces | 3.0.3+~3.0.4-1 | — |
| Debian 12 | node-braces | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-braces | No fix yet | — |
| Ubuntu 26.04 LTS | node-braces | No fix yet | — |
| Ubuntu 25.10 | node-braces | No fix yet | — |
| Ubuntu 24.04 LTS | node-braces | No fix yet | — |
| Ubuntu 22.04 LTS | node-braces | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | node-braces | No fix yet | — |
| Ubuntu 18.04 LTS | node-braces | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.24-1.Final_redhat_00001.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 6.0.23-2.SP1_redhat_00001.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.18-1.Final_redhat_00001.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-jboss-cert-helper +1 | 1.1.3-1.redhat_00001.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.55-1.Final_redhat_00001.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-39.Final_redhat_00039.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-jbossws-cxf | 5.4.12-1.Final_redhat_00001.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-jsoup | 1.15.4-1.redhat_00003.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-undertow-jastow | 2.0.15-1.Final_redhat_00001.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.19-1.GA_redhat_00002.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.19-1.GA_redhat_00002.1.el8eap | RHSA-2024:8077, RHSA-2024:8076 |
| Red Hat JBoss EAP 7 | eap7-xalan-j2 | 2.7.1-37.redhat_00015.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SLES 15 SP4 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SLES 15 SP3 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SLES 3 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1, SUSE-SU-2025:01326-1, SUSE-SU-2024:3771-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SLES for SAP 15 SP4 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SLES for SAP 15 SP3 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SLE HPC 15 SP5 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SLE HPC 15 SP4 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SLE HPC 15 SP3 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SUSE Manager Server 4.3 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SUSE Manager Proxy 4.3 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SUSE Enterprise Storage 7.1 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | traefik | 3.1.2-1.1 | openSUSE-SU-2024:14257-1 |
| openSUSE Tumbleweed | traefik2 | 2.11.8-1.1 | openSUSE-SU-2024:14258-1 |
| openSUSE Tumbleweed | velociraptor | 0.7.0.4.git142.862ef23-1.1 | openSUSE-SU-2025:14663-1 |
| openSUSE Leap 15.6 | pgadmin4 | 8.5-150600.3.6.1 | SUSE-SU-2024:3771-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | nodejs-nodemon | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | nodejs-nodemon | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | reaper | 3.1.1-9 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-workflows | 3.6.5-r2 | — |
| Wolfi rolling | kubeflow-pipelines-frontend | 2.15.0-r1 | — |
| Wolfi rolling | lerna | 8.1.4-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | braces | < 3.0.3 | 3.0.3 | GHSA-grv7-fg5c-xmjg |
Advisories 15
- RHSA-2024:8077 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.19 Security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2024:8075 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.19 Security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2024:8076 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.19 Security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- WID-SEC-2025-0001 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
- WID-SEC-2024-2036 Red Hat OpenShift: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jul 1, 2026
- SUSE-SU-2025:01326-1 Security update for pgadmin4 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:1326-1 Security update for pgadmin4 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14663-1 velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3771-1 Security update for pgadmin4 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14258-1 traefik2-2.11.8-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14257-1 traefik-3.1.2-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2025-0043 IBM QRadar SIEM (Log Source Management App): Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 17, 2025
- NCSC-2024-0466 Kwetsbaarheden verholpen in Atlassian producten NCSC-NL (Netherlands) · Dec 6, 2024
- WID-SEC-2024-3508 Atlassian Confluence: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 19, 2024
- WID-SEC-2024-1566 IBM QRadar SIEM: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jul 9, 2024