search

paulmillr / chokidar

Minimal and efficient cross-platform file watching library
https://paulmillr.com
MIT License
10.8k stars 574 forks source link

NPM- braces package fails to limit the number of characters and could lead to memory exhaustion #1328

Closed yadabnepal closed 2 months ago

yadabnepal commented 2 months ago

The NPM package braces fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.

Update package braces with version 3.0.3 or higher.

https://github.com/micromatch/braces/pull/38

paulmillr commented 2 months ago

@yadabnepal go learn how version ranges work and don't waste my time