npmPackage

braces

3 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Latest release: 3.0.3 (May 21, 2024): affected by CVE-2026-93687
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 3 · 2 high

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-93687High 8.7
braces through 3.0.3 Stack Overflow via Deeply Nested Patterns
Affected: through 3.0.3.
No fix released. The latest release, 3.0.3, is still affected.
100% of braces downloads last week were affected versions (251.6M).
CVE-2024-4068High 7.5
Memory Exhaustion in braces
Affected: through 3.0.2; fixed in 3.0.3.
Fixed in 3.0.3 (released May 21, 2024, 8 days after disclosure).
The latest release, 3.0.3, is not affected.
15% of braces downloads last week were affected versions (38.3M).
CVE-2018-1109Unrated
A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1.
Affected: from 2.2.0, fixed in 2.3.1.
Fixed in 2.3.1 (released Feb 18, 2018, 1136 days before disclosure).
The latest release, 3.0.3, is not affected.
<0.1% of braces downloads last week were affected versions (40.2K).