[GHSA-vfj7-8cjw-p6xm] braces vulnerable to stack-exhaustion denial of service through deeply nested patterns

[VicRobNes]

Updates

• Affected products
• CVSS v3
• Description
• References

Comments
NDC Inc. checked the published npm 3.0.3 package and its public source. The proposed text names all three affected public methods. It also makes process termination conditional on an unhandled error. In isolated tests on Node.js 22.23.3, a 9,000-character nested pattern caused stack errors. The affected methods were compile, expand, and stringify.

A direct, unhandled expand call exited with status 1. On Node.js 24.21.0, the same direct call exited in 19 of 20 trials at 10,000 characters. It exited in 2 of 20 trials at 9,000 characters. The variable threshold supports the runtime qualification.

The new references show the public methods, the input limit, and the stringify walker. No released fixed version was found. Open upstream patch proposals remain unmerged and are not listed as patched versions.

Submission note: GitHub's improvement form also removed the existing CVSS v3 vector. NDC Inc. did not assess or request a severity change. Please retain the current CVSS v3 metadata when reviewing this description and its references.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[VicRobNes]

Curator note: GitHub's advisory improvement form removed the existing CVSS v3 vector in the generated changes. NDC Inc. did not assess or request a change to the severity score. Please keep the current CVSS v3 vector and score when you review this request. Our research supports the updated description and references.