StackPrism

npm package

braces vulnerabilities by version

The latest release, 3.0.3 (May 21, 2024), has 1 known vulnerability. 100% of last week’s 169.1M downloads went to versions with known vulnerabilities. OSV.dev lists 3 advisories for braces; the newest was published on Sep 18, 2026.

npm (opens in a new tab) describes it as “Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.”

Latest release
3.0.3
May 21, 2024, 1 known vulnerabilities
Downloads last week
169.1M
All versions, from npm
Advisories on OSV.dev
3
Newest Sep 18, 2026
Licence
MIT
OpenSSF Scorecard
3.8/10
micromatch/braces (opens in a new tab)

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
3.0.3latestMay 21, 20241 known vulnerability, worst rated critical143.2M
2.3.2Apr 8, 20182 known vulnerabilities, worst rated critical12.4M
3.0.2Apr 16, 20192 known vulnerabilities, worst rated critical11M
1.8.5May 21, 20162 known vulnerabilities, worst rated critical2.3M
0.1.5Nov 24, 20142 known vulnerabilities, worst rated critical245.7K
2.3.1Feb 18, 20182 known vulnerabilities, worst rated critical53.6K
2.3.0Oct 19, 20173 known vulnerabilities, worst rated critical27.7K
2.2.2May 31, 20173 known vulnerabilities, worst rated critical3.4K

Who is still on a vulnerable braces

100% of last week’s 169.1M braces downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

The newest release of each major line, from the registry. braces doesn’t publish support dates we can check.

LineNewest releaseReleased
33.0.3May 21, 2024
22.3.2Apr 8, 2018
11.8.5May 21, 2016
0.10.1.5Nov 24, 2014

Newest advisories

The 3 most recently published, with the versions each one affects.

  1. CriticalCVE-2026-93687 on OSV.dev (opens in a new tab)GHSA-vfj7-8cjw-p6xm

    braces vulnerable to stack-exhaustion denial of service through deeply nested patterns

    Affects <= 3.0.3. Published Sep 18, 2026.

  2. CriticalCVE-2024-4068 on OSV.dev (opens in a new tab)GHSA-grv7-fg5c-xmjg

    Uncontrolled resource consumption in braces

    Affects < 3.0.3. Published May 14, 2024.

  3. LowCVE-2018-1109 on OSV.dev (opens in a new tab)GHSA-cwfw-4gq5-mrqx

    Regular Expression Denial of Service (ReDoS) in braces

    Affects >= 2.2.0, < 2.3.1. Published Jan 6, 2022.

Which braces do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for braces, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm and deps.dev.