Repository navigation
[GHSA-vfj7-8cjw-p6xm] braces vulnerable to stack-exhaustion denial of service through deeply nested patterns - #10400
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
The revised CVSS impact and exploitation metrics do not support the severity downgrade.
2 open findings
What changed in this PR
Reassesses the braces stack-exhaustion advisory’s severity following maintainer feedback.
Changes:
- Removes CVSS v3 scoring and revises the CVSS v4 vector.
- Lowers severity from HIGH to LOW and updates the modification timestamp.
| File | Description |
|---|---|
| advisories/github-reviewed/2026/09/GHSA-vfj7-8cjw-p6xm/GHSA-vfj7-8cjw-p6xm.json | Revises vulnerability scoring and severity metadata. |
🧠 Review effort: Max
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| { | ||
| "type": "CVSS_V4", | ||
| "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" | ||
| "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L" |
There was a problem hiding this comment.
Letting users pass regexes/regex globs unsanitized to braces is not a reasonable worst-case scenario. Avoiding this is general best practices, and not something a regex engines needs to defend itself against. That is not a reasonable ask. As the maintainer aptly put it, it's equivalent to asking javascript to defend developers against doing while (true) {}, and saying while loops are a high severity security vulnerability.
| { | ||
| "type": "CVSS_V4", | ||
| "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" | ||
| "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L" |
Updates
Comments
See maintainer comment micromatch/braces#70
This can only be abused under highly specific conditions, so at least the score must be lowered or the CVE should be removed/invalidated altogether.