[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2024-4068":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-01T16:22:42.503Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":93,"aliases":103,"duplicate_of":9,"upstream":105,"downstream":106,"duplicates":129,"related":130,"reserved_at":9,"published_at":151,"modified_at":152,"state":153,"summary":154,"references_raw":162,"kevs":207,"epss":208,"epss_history":211,"metrics":480,"affected":490},"CVE-2024-4068","The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.",null,[11,19],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-1050","Excessive Platform Resource Consumption within a Loop","The product has a loop body or loop condition that contains a control element that directly or\n\t\t\t\t\tindirectly consumes platform resources, e.g. messaging, sessions, locks, or file\n\t\t\t\t\tdescriptors.","weakness","Incomplete","Base",[],{"_key":20,"id":20,"name":21,"description":22,"type":15,"status":23,"abstraction":24,"likelihood_of_exploit":25,"capec":26},"CWE-400","Uncontrolled Resource Consumption","The product does not properly control the allocation and maintenance of a limited resource.","Draft","Class","High",[27,31,89],{"id":28,"name":29,"techniques":30},"CAPEC-147","XML Ping of the Death",[],{"id":32,"name":33,"techniques":34},"CAPEC-227","Sustained Client Engagement",[35],{"id":36,"name":37,"tactics":38,"countermeasures":42},"T1499","Endpoint Denial of Service",[39],{"id":40,"name":41},"TA0105","Impact",[43,48,52,56,60,64,68,72,76,80,85],{"id":44,"name":45,"tactic":46},"D3-UGLPA","User Geolocation Logon Pattern Analysis",{"name":47},"Detect",{"id":49,"name":50,"tactic":51},"D3-PMAD","Protocol Metadata Anomaly Detection",{"name":47},{"id":53,"name":54,"tactic":55},"D3-CSPP","Client-server Payload Profiling",{"name":47},{"id":57,"name":58,"tactic":59},"D3-PHDURA","Per Host Download-Upload Ratio Analysis",{"name":47},{"id":61,"name":62,"tactic":63},"D3-NTSA","Network Traffic Signature Analysis",{"name":47},{"id":65,"name":66,"tactic":67},"D3-APCA","Application Protocol Command Analysis",{"name":47},{"id":69,"name":70,"tactic":71},"D3-NTCD","Network Traffic Community Deviation",{"name":47},{"id":73,"name":74,"tactic":75},"D3-RTSD","Remote Terminal Session Detection",{"name":47},{"id":77,"name":78,"tactic":79},"D3-ISVA","Inbound Session Volume Analysis",{"name":47},{"id":81,"name":82,"tactic":83},"D3-NTF","Network Traffic Filtering",{"name":84},"Isolate",{"id":86,"name":87,"tactic":88},"D3-ITF","Inbound Traffic Filtering",{"name":84},{"id":90,"name":91,"techniques":92},"CAPEC-492","Regular Expression Exponential Blowup",[],[94],{"_key":95,"name":96,"source":97,"url":98,"maturity":99,"reliability_score":100,"verified":101,"type":9,"platforms":102,"requires_auth":9,"exploitdb":9,"metasploit":9},"GITHUB_MICROMATCH_BRACES","Braces","github","https://github.com/micromatch/braces/pull/37","poc",0.3,false,[],[104],"GHSA-grv7-fg5c-xmjg",[],[107,109,111,113,115,117,119,121,123,125,127],{"_key":108},"OPENSUSE-SU-2024:14257-1",{"_key":110},"SUSE-SU-2025:1326-1",{"_key":112},"SUSE-SU-2024:3771-1",{"_key":114},"OPENSUSE-SU-2024:14258-1",{"_key":116},"OPENSUSE-SU-2025:14663-1",{"_key":118},"SUSE-SU-2025:01326-1",{"_key":120},"UBUNTU-CVE-2024-4068",{"_key":122},"DEBIAN-CVE-2024-4068",{"_key":124},"RHSA-2024:8075",{"_key":126},"RHSA-2024:8076",{"_key":128},"RHSA-2024:8077",[],[131,132,133,134,135,136,137,139,141,143,145,147,149],{"_key":108},{"_key":110},{"_key":112},{"_key":114},{"_key":116},{"_key":118},{"_key":138},"CGA-G3X5-7MR7-WR8M",{"_key":140},"CGA-HQ78-8245-675V",{"_key":142},"CGA-JRQH-C82G-RXVM",{"_key":144},"CGA-P4GW-WX75-2MG4",{"_key":146},"CGA-W95G-RRW2-66H4",{"_key":148},"CGA-WR9W-HW24-RQG5",{"_key":150},"CGA-8HVF-38PW-FQJ9","2024-05-13T10:06:38.152Z","2024-11-06T13:10:11.179Z","Analyzed",{"cisa_kev":101,"cisa_ransomware":101,"cisa_vendor":9,"epss_severity":155,"epss_score":156,"severity":157,"severity_score":158,"severity_version":159,"severity_source":160,"severity_vector":161,"severity_status":153},"low",0.01471,"high",7.5,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",[163,171,176,181,185,189,194,198,203],{"url":164,"sources":165,"tags":168},"https://github.com/micromatch/braces/issues/35",[160,166,167],"nvd","osv_npm",[169,170],"Issue Tracking","WEB",{"url":172,"sources":173,"tags":174},"https://devhub.checkmarx.com/cve-details/CVE-2024-4068/",[160,166],[175],"Third Party Advisory",{"url":98,"sources":177,"tags":178},[160,166,167],[179,169,180,170],"Exploit","Patch",{"url":182,"sources":183,"tags":184},"https://github.com/micromatch/braces/pull/40",[160,166,167],[169,180,170],{"url":186,"sources":187,"tags":188},"https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff",[160,166,167],[180,170],{"url":190,"sources":191,"tags":192},"https://nvd.nist.gov/vuln/detail/CVE-2024-4068",[167],[193],"Advisory",{"url":195,"sources":196,"tags":197},"https://devhub.checkmarx.com/cve-details/CVE-2024-4068",[167],[170],{"url":199,"sources":200,"tags":201},"https://github.com/micromatch/braces",[167],[202],"PACKAGE",{"url":204,"sources":205,"tags":206},"https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js#L308",[167],[170],[],{"date":209,"score":156,"percentile":210},"2026-07-06",0.70637,[212,216,219,222,225,228,231,234,237,240,243,246,249,252,255,259,262,265,269,272,275,278,281,284,287,290,293,296,300,303,306,309,312,315,318,321,324,327,330,333,336,339,341,344,347,350,353,356,358,361,364,367,370,373,376,379,382,384,387,391,394,397,400,403,405,408,411,414,417,420,423,426,429,432,435,438,440,443,446,449,452,455,457,460,463,466,469,471,474,477],{"date":213,"score":214,"percentile":215},"2025-11-04",0.00225,0.45094,{"date":217,"score":214,"percentile":218},"2025-11-05",0.45083,{"date":220,"score":214,"percentile":221},"2025-11-06",0.45096,{"date":223,"score":214,"percentile":224},"2025-11-07",0.45121,{"date":226,"score":214,"percentile":227},"2025-11-08",0.45119,{"date":229,"score":214,"percentile":230},"2025-11-09",0.45101,{"date":232,"score":214,"percentile":233},"2025-11-10",0.45063,{"date":235,"score":214,"percentile":236},"2025-11-11",0.45077,{"date":238,"score":214,"percentile":239},"2025-11-12",0.45109,{"date":241,"score":214,"percentile":242},"2025-11-13",0.45117,{"date":244,"score":214,"percentile":245},"2025-11-14",0.45134,{"date":247,"score":214,"percentile":248},"2025-11-15",0.45129,{"date":250,"score":214,"percentile":251},"2025-11-16",0.45112,{"date":253,"score":214,"percentile":254},"2025-11-17",0.45087,{"date":256,"score":257,"percentile":258},"2025-11-18",0.01665,0.80571,{"date":260,"score":257,"percentile":261},"2025-11-19",0.80573,{"date":263,"score":257,"percentile":264},"2025-11-20",0.80579,{"date":266,"score":267,"percentile":268},"2025-11-21",0.00203,0.42533,{"date":270,"score":267,"percentile":271},"2025-11-22",0.42534,{"date":273,"score":267,"percentile":274},"2025-11-23",0.42504,{"date":276,"score":214,"percentile":277},"2025-11-24",0.45044,{"date":279,"score":214,"percentile":280},"2025-11-25",0.45055,{"date":282,"score":267,"percentile":283},"2025-11-26",0.42505,{"date":285,"score":267,"percentile":286},"2025-11-27",0.42508,{"date":288,"score":267,"percentile":289},"2025-11-28",0.42479,{"date":291,"score":267,"percentile":292},"2025-11-29",0.42458,{"date":294,"score":267,"percentile":295},"2025-11-30",0.42439,{"date":297,"score":298,"percentile":299},"2025-12-01",0.00143,0.35201,{"date":301,"score":298,"percentile":302},"2025-12-02",0.35211,{"date":304,"score":298,"percentile":305},"2025-12-03",0.3521,{"date":307,"score":267,"percentile":308},"2025-12-04",0.42436,{"date":310,"score":267,"percentile":311},"2025-12-05",0.42461,{"date":313,"score":267,"percentile":314},"2025-12-06",0.4245,{"date":316,"score":267,"percentile":317},"2025-12-07",0.42429,{"date":319,"score":267,"percentile":320},"2025-12-08",0.42432,{"date":322,"score":214,"percentile":323},"2025-12-09",0.45033,{"date":325,"score":214,"percentile":326},"2025-12-10",0.45099,{"date":328,"score":214,"percentile":329},"2025-12-11",0.45124,{"date":331,"score":214,"percentile":332},"2025-12-12",0.45153,{"date":334,"score":214,"percentile":335},"2025-12-13",0.45138,{"date":337,"score":214,"percentile":338},"2025-12-14",0.4512,{"date":340,"score":214,"percentile":230},"2025-12-15",{"date":342,"score":214,"percentile":343},"2025-12-16",0.45122,{"date":345,"score":214,"percentile":346},"2025-12-17",0.45152,{"date":348,"score":214,"percentile":349},"2025-12-18",0.45199,{"date":351,"score":214,"percentile":352},"2025-12-19",0.45211,{"date":354,"score":214,"percentile":355},"2025-12-20",0.45185,{"date":357,"score":214,"percentile":346},"2025-12-21",{"date":359,"score":214,"percentile":360},"2025-12-22",0.45131,{"date":362,"score":214,"percentile":363},"2025-12-23",0.4513,{"date":365,"score":214,"percentile":366},"2025-12-24",0.4514,{"date":368,"score":214,"percentile":369},"2025-12-25",0.45189,{"date":371,"score":214,"percentile":372},"2025-12-26",0.45171,{"date":374,"score":214,"percentile":375},"2025-12-27",0.4519,{"date":377,"score":214,"percentile":378},"2025-12-28",0.45104,{"date":380,"score":214,"percentile":381},"2025-12-29",0.45088,{"date":383,"score":214,"percentile":218},"2025-12-30",{"date":385,"score":214,"percentile":386},"2025-12-31",0.45127,{"date":388,"score":389,"percentile":390},"2026-01-01",0.00159,0.37505,{"date":392,"score":389,"percentile":393},"2026-01-02",0.37475,{"date":395,"score":389,"percentile":396},"2026-01-03",0.37464,{"date":398,"score":214,"percentile":399},"2026-01-04",0.45066,{"date":401,"score":214,"percentile":402},"2026-01-05",0.4505,{"date":404,"score":214,"percentile":280},"2026-01-06",{"date":406,"score":214,"percentile":407},"2026-01-07",0.45074,{"date":409,"score":214,"percentile":410},"2026-01-08",0.451,{"date":412,"score":214,"percentile":413},"2026-01-09",0.45073,{"date":415,"score":214,"percentile":416},"2026-01-10",0.45067,{"date":418,"score":214,"percentile":419},"2026-01-11",0.45047,{"date":421,"score":214,"percentile":422},"2026-01-12",0.44997,{"date":424,"score":214,"percentile":425},"2026-01-13",0.44972,{"date":427,"score":214,"percentile":428},"2026-01-14",0.45022,{"date":430,"score":214,"percentile":431},"2026-01-15",0.45018,{"date":433,"score":214,"percentile":434},"2026-01-16",0.45036,{"date":436,"score":214,"percentile":437},"2026-01-17",0.45011,{"date":439,"score":214,"percentile":425},"2026-01-18",{"date":441,"score":214,"percentile":442},"2026-01-19",0.44957,{"date":444,"score":214,"percentile":445},"2026-01-20",0.44952,{"date":447,"score":214,"percentile":448},"2026-01-21",0.44956,{"date":450,"score":214,"percentile":451},"2026-01-22",0.44959,{"date":453,"score":214,"percentile":454},"2026-01-23",0.4501,{"date":456,"score":214,"percentile":431},"2026-01-24",{"date":458,"score":214,"percentile":459},"2026-01-25",0.44962,{"date":461,"score":214,"percentile":462},"2026-01-26",0.44921,{"date":464,"score":214,"percentile":465},"2026-01-27",0.44926,{"date":467,"score":214,"percentile":468},"2026-01-28",0.4493,{"date":470,"score":214,"percentile":462},"2026-01-29",{"date":472,"score":214,"percentile":473},"2026-01-30",0.44931,{"date":475,"score":214,"percentile":476},"2026-01-31",0.44939,{"date":478,"score":389,"percentile":479},"2026-02-01",0.37108,[481,486,488],{"source":160,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":482,"cvss_v4_0":9},{"baseScore":158,"baseSeverity":483,"vectorString":161,"impactScore":484,"exploitabilityScore":485},"HIGH",6,10,{"source":166,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":487,"cvss_v4_0":9},{"baseScore":158,"baseSeverity":483,"vectorString":161,"impactScore":484,"exploitabilityScore":485},{"source":167,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":489,"cvss_v4_0":9},{"baseScore":158,"baseSeverity":9,"vectorString":161,"impactScore":484,"exploitabilityScore":485},[491,502,509],{"ecosystem":9,"name":492,"vendor":493,"product":492,"cpe_part":494,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":495},"braces","jonschlinkert","a",[496],{"version":497,"is_range":498,"range_type":499,"version_start":9,"version_start_type":9,"version_end":500,"version_end_type":501,"fixed_in":9},"lt3.0.3",true,"cpe","3.0.3","excluding",{"ecosystem":9,"name":492,"vendor":503,"product":492,"cpe_part":494,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":504},"micromatch",[505],{"version":506,"is_range":498,"range_type":160,"version_start":9,"version_start_type":9,"version_end":507,"version_end_type":508,"fixed_in":9},"\u003C= 3.0.2","3.0.2","including",{"ecosystem":510,"name":492,"vendor":510,"product":492,"cpe_part":9,"purl_type":511,"purl_namespace":9,"purl_name":492,"source":9,"versions":512},"Npm","npm",[513],{"version":514,"is_range":498,"range_type":515,"version_start":9,"version_start_type":9,"version_end":500,"version_end_type":501,"fixed_in":9},"lt3_0_3","semver"]