braces package (version 3.0.2)

[DOodle25]

Vulnerability:
The braces package in DIDFrontend/package-lock.json has a memory exhaustion vulnerability. The issue arises from the package's failure to limit the number of characters it can handle during parsing.

Affected Component(s):

• braces package (version 3.0.2)

Description:
The NPM package braces prior to version 3.0.3 is vulnerable to a memory exhaustion attack. The vulnerability occurs in lib/parse.js, where if a malicious user sends "imbalanced braces" as input, the package enters an infinite loop while attempting to parse the input. During this loop, heap memory is continuously allocated without being freed. As a result, the program eventually exceeds the JavaScript heap limit and crashes.

Severity:

• High

Potential Impact:

• Denial of Service (DoS) due to memory exhaustion, potentially crashing the application or making it unresponsive.

Suggested Fix:

• Upgrade the braces package from version 3.0.2 to 3.0.3 in DIDFrontend/package-lock.json to mitigate this vulnerability.