CVE-2024-4068 Memory Exhaustion in braces
An attacker can cause a denial of service by sending imbalanced braces to the braces library, triggering infinite memory allocation and crashing the application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-4068?
CVE-2024-4068 is a high-severity denial of service vulnerability in micromatch braces, published on 13 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Which versions are affected by CVE-2024-4068?
2 open source packages ship an affected version, including braces. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
braces npm | All versions | 3.0.3 |
braces npm | All versions | 3.0.3 |
Products include Jonschlinkert Braces.
How do I fix CVE-2024-4068?
Upgrade braces to 3.0.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-4068 being exploited?
There is no known exploitation of CVE-2024-4068 in the wild and no public exploit code.
Sources
Also known as AZL-42034, AZL-44020, AZL-44562, CLEANSTART-2026-LF83973, CLEANSTART-2026-LX13962, CLSA-2026-1771546208 and 11 more.