GHSA-g95f-p29q-9xw4

Source

https://github.com/advisories/GHSA-g95f-p29q-9xw4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-g95f-p29q-9xw4/GHSA-g95f-p29q-9xw4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g95f-p29q-9xw4

Withdrawn

2026-02-03T17:47:36Z

Published

2019-06-06T15:30:30Z

Modified

2026-02-03T18:02:34Z

Severity

3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

Duplicate Advisory: Regular Expression Denial of Service in braces

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-cwfw-4gq5-mrqx. This link is maintained to preserve external references.

Original Description

Versions of braces prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Recommendation

Upgrade to version 2.3.1 or higher.

Database specific

{
    "cwe_ids":  [
        "CWE-185",
        "CWE-400"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2019-06-06T09:40:51Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

Affected packages

npm / braces

Package

Name: braces; View open source insights on deps.dev
Purl: pkg:npm/braces

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.3.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-g95f-p29q-9xw4/GHSA-g95f-p29q-9xw4.json"