CVE-2024-4068

🗓️ 13 May 2024 10:06:38Reported by CheckmarxType

Memory Exhaustion due to unhandled characters in NPM package 'braces'

Reporter	Title	Published	Views	Family All 175
IBM Security Bulletins	Security Bulletin: IBM Security QRadar EDR Software contains multiple vulnerabilities	8 Jul 202409:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics Mobile (Android) is affected by multiple vulnerabilities	21 Oct 202415:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js braces	29 Jul 202421:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities	6 May 202519:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Wincollect is using components with known vulnerabilities	9 Jul 202417:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Data Virtualization on Cloud Pak for Data (February 2025)	15 Apr 202503:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities fixed in IBM Security Verify Information Queue	5 Aug 202409:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to Node.js micromatch & braces modules (CVE-2024-4067 & CVE-2024-4068)	14 Jun 202410:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data	15 Apr 202502:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Node.js braces module denial of service vulnerability [ CVE-2024-4068]	28 Jan 202522:08	–	ibm

NVD

Node

jonschlinkert bracesRange<3.0.3node.js

[
  {
    "collectionURL": "https://www.npmjs.com/package/micromatch",
    "defaultStatus": "unknown",
    "packageName": "braces",
    "product": "braces",
    "programFiles": [
      "lib/parse.js"
    ],
    "repo": "https://github.com/micromatch/braces",
    "vendor": "micromatch",
    "versions": [
      {
        "changes": [
          {
            "at": "3.0.3",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.0.2",
        "status": "affected",
        "version": "0",
        "versionType": "git"
      }
    ]
  }
]

Source	Link
github	www.github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff
github	www.github.com/micromatch/braces/pull/37
devhub	www.devhub.checkmarx.com/cve-details/CVE-2024-4068/
github	www.github.com/micromatch/braces/pull/40
github	www.github.com/micromatch/braces/issues/35

31 Dec 2025 01:04Current

7.4High risk

Vulners AI Score7.4

CVSS 3.17.5

EPSS0.00275

SSVC