Vulnerabilities

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns.

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards.

Picomatch is a glob matcher written JavaScript.

Picomatch is a glob matcher written JavaScript.

toggle-array is a package designed to enables a property on the object at the specified index, while disabling the property on all other objects.

An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function

The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion.

The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS).