GHSA-g95f-p29q-9xw4

What it actually does

The vulnerable npm package contains a regular expression that can exhibit catastrophic backtracking when processing specially crafted brace-pattern input. An attacker who can cause an application to pass untrusted or attacker-controlled strings into the affected braces parsing/expansion functionality may trigger excessive CPU consumption and event-loop blocking. The impact is denial of service rather than code execution, privilege escalation, or data disclosure. The issue is fixed in braces 2.3.1.

Why it matters to the business

Applications that depend on the affected braces package may become slow or temporarily unavailable if exposed functionality processes maliciously crafted patterns. Because braces is commonly pulled in transitively by JavaScript build, globbing, and file-matching tooling, exposure may exist indirectly through downstream dependencies. The CVSS score is low and there is no known KEV listing or mature public exploitation indicated, but long-lived unpatched dependencies can still create operational risk in services that parse user-supplied patterns.

How an attack unfolds

An attacker first identifies an application feature, API parameter, configuration upload, search/filter expression, file-matching endpoint, or other workflow that eventually passes user-controlled text to the vulnerable braces package. They then submit an intentionally complex brace expression designed to trigger inefficient regular-expression evaluation. When the Node.js process evaluates the expression, CPU usage can spike and the event loop may be blocked, delaying or preventing normal request handling. Repeated requests or concurrent submissions can amplify the effect and cause partial or complete service degradation until the process recovers, is restarted, or upstream rate limits stop the traffic.

How to fix it

Upgrade the braces npm package to version 2.3.1 or later. If braces is present as a transitive dependency, update the top-level packages that depend on it, refresh the package lockfile, and verify that dependency resolution no longer selects a vulnerable version. Where immediate upgrade is not possible, reduce exposure by rejecting or strictly bounding user-supplied pattern input, limiting maximum input length and nesting/brace complexity, applying request rate limits, enforcing request timeouts, and isolating pattern-processing workloads from critical request paths.

How to confirm the fix worked

Confirm remediation by inspecting dependency manifests and lockfiles with tools such as npm ls braces, npm audit, yarn why braces, or software composition analysis tooling, and verify that all resolved braces versions are 2.3.1 or later. Run application tests that cover pattern parsing and glob-like input handling. For exposed services, perform safe negative testing with oversized or malformed pattern inputs in a controlled environment and confirm requests are rejected, timed out, or handled without abnormal CPU spikes or event-loop delay. Rebuild and redeploy artifacts to ensure the fixed dependency is actually present in runtime images and packages.

Typical attack path

1. Identify a public or authenticated application feature that accepts pattern-like input, glob expressions, file masks, filters, or configuration values.
2. Confirm that submitted input is processed by functionality depending on the vulnerable braces npm package, directly or transitively.
3. Send a crafted brace-pattern payload intended to trigger excessive regular-expression backtracking.
4. Observe increased response latency, timeouts, elevated CPU usage, or Node.js event-loop saturation.
5. Repeat or parallelize requests to sustain denial of service against the affected process or service.

How to detect it

Because this issue causes resource exhaustion rather than creating a unique file, process, or command artifact, detection should focus on evidence of abnormal request patterns followed by CPU saturation, Node.js event-loop lag, application timeouts, or process restarts. Review web server, API gateway, WAF, and application logs for repeated requests containing unusually long or deeply nested brace, glob, or pattern-like strings. Correlate those requests with spikes in CPU usage, elevated response latency, 499/500/502/503/504 responses, Node.js heap or event-loop delay warnings, container restarts, autoscaling events, and watchdog-triggered process restarts. If package-level telemetry or application debug logs exist around pattern parsing, look for failures or unusually slow handling of brace expansion, glob parsing, or file-match operations. There are no advisory-specific attacker IPs, filenames, registry keys, or malware artifacts derivable from the provided information.

• braces@2.3.0
• braces@2.2.
• braces@2.1.
• braces@2.0.
• node_modules/braces/package.json
• package-lock.json: "braces"
• yarn.lock: braces@
• HTTP 503
• HTTP 504
• JavaScript heap out of memory
• Event loop delay
• EAI_AGAIN
• upstream timed out
• context deadline exceeded

What your security team should do

• Inventory applications and build/runtime artifacts that include the braces npm package, including transitive dependencies.
• Prioritize remediation for internet-facing services or APIs that accept user-controlled pattern, glob, filter, search, or configuration input.
• Upgrade braces to 2.3.1 or later and regenerate lockfiles to prevent vulnerable versions from being reintroduced.
• Add input validation and length/complexity limits around any feature that processes brace or glob patterns from untrusted sources.
• Ensure application-layer rate limiting, request timeouts, and process supervision are in place to limit denial-of-service impact.
• Monitor dependency scanning results for reintroduction of vulnerable braces versions in CI/CD pipelines.