Vulnerability detected in dependent library Braces (CWE-400)
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 43.3k
- Forks
- 2.7k
- PR merge metrics
- No merged PRs in 30d
Description
Checkmarx reported vulnerability with one of the dependent libraries (braces@3.0.2).
Category
CWE-400 | Uncontrolled resource consumption
Description
The NPM package "braces" fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In "lib/parse.js," if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Steps to reproduce
Run checkmarx scan on any nodejs project with pm2 dependency
Dependency tree
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the dependency tree in the issue and identify how pm2 brings in braces@3.0.2; review the reported behavior in braces' lib/parse.js and run a Checkmarx scan on the project. Done means the vulnerable dependency is no longer reported and the dependency resolution remains valid.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- devtools, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100