braces (npm)
Faster brace expansion for node.js. Besides being faster, braces is not subject to DoS attacks like minimatch, is more accurate, and has more complete support for Bash 4.3.
Advisories
7
Latest version
3.0.3
Released May 21, 2024
License
MIT
OpenSSF Scorecard
3.8 / 10
How to fix
Upgrading to 3.0.3 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install braces@3.0.3yarn
yarn add braces@3.0.3pnpm
pnpm add braces@3.0.3Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-vfj7-8cjw-p6xm Withdrawn Advisory: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns Withdrawn |
High EPSS 0.76% |
<= 3.0.3 | No fix yet |
| GHSA-vfj7-8cjw-p6xm Withdrawn Advisory: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns Withdrawn |
High EPSS 0.76% |
<= 3.0.3 | No fix yet |
| GHSA-grv7-fg5c-xmjg Uncontrolled resource consumption in braces |
High EPSS 1.47% |
< 3.0.3 | 3.0.3 |
| GHSA-cwfw-4gq5-mrqx Regular Expression Denial of Service (ReDoS) in braces |
Medium EPSS 1.39% |
>= 2.2.0, < 2.3.1 | 2.3.1 |
| GHSA-cwfw-4gq5-mrqx Regular Expression Denial of Service (ReDoS) in braces |
Medium EPSS 1.39% |
>= 2.2.0, < 2.3.1 | 2.3.1 |
| GHSA-g95f-p29q-9xw4 Duplicate Advisory: Regular Expression Denial of Service in braces Withdrawn |
Low | < 2.3.1 | 2.3.1 |
| GHSA-g95f-p29q-9xw4 Duplicate Advisory: Regular Expression Denial of Service in braces Withdrawn |
Low | < 2.3.1 | 2.3.1 |
Source: git+https://github.com/micromatch/braces.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor