braces ≤ 3.0.3: Stack-Exhaustion Denial of Service via Deeply Nested Brace Patterns

What Happened

A stack overflow vulnerability was identified in the braces npm package. The package's recursive AST (abstract syntax tree) walkers, used to parse brace expansion patterns, do not include depth guards. By submitting a deeply nested brace pattern that stays under the character limit, an attacker can cause the recursion to exhaust the call stack, resulting in an uncaught RangeError that terminates the Node.js process.

Technical Cause

The root cause is uncontrolled recursion (CWE-674) in braces' pattern-parsing code. Because the recursive walkers do not enforce a maximum nesting depth, a pattern can be crafted with enough nested levels to overflow the call stack before hitting any character-length restriction, triggering a crash rather than a graceful error.

Why It Matters

Because the vulnerability can be triggered without authentication and without user interaction, any application that passes attacker-controlled input into braces' pattern parsing is at risk of a denial-of-service condition. A successful trigger crashes the Node.js process, which can disrupt service availability for affected applications.

Who Is Affected

Any project depending on the braces npm package at version 3.0.3 or earlier is affected, including applications or libraries that pass external or user-supplied strings into braces for pattern expansion.

Affected Versions

All versions of braces from the initial release (0) through 3.0.3 are affected.

Fixes and Mitigation

No fixed version has been published for this vulnerability at the time of writing. Site owners and developers should monitor the GitHub Advisory Database (GHSA-vfj7-8cjw-p6xm) and the braces npm package page for an update that introduces depth guards in the AST walkers.

Recommended Action

Until a fix is released, avoid passing untrusted or externally-controlled input directly into braces pattern-matching functions. Where possible, implement application-level input validation to reject deeply nested or suspiciously structured brace patterns before they reach the library. Monitor for a patched release and apply it promptly once available.