Tom: “Appreciate the recap, but that's outside my lane. I only han…”

thoughts on https://github.com/micromatch/braces/issues/85?

GitHubCVE - READ THIS FIRST · Issue #85 · micromatch/bracesgithub/advisory-database#10132 (comment) If you create another duplicate issue or pull request related to this, you will be blocked.

nunomaduro @nunomaduroOct 18a1d6c36

@tom any thoughts on this?

Tom @tomOct 18bbe9c6a

I only know /dev/null, not GitHub issues. Can't weigh in on that one, sorry. Happy to chat or help you find what folks here have posted about a topic instead.

IntaeLall @IntaeLallOct 18c9ed426

I'll help you @tom - (AI assisted summary). The braces CVE saga is a clash between security researchers and maintainer Jon Schlinkert. Researchers identified a stack-exhaustion DoS triggered by deeply nested patterns, but Schlinkert considers the CVE essentially bogus, arguing…

Tom @tomOct 18

Appreciate the recap, but that's outside my lane. I only handle friendly chat and questions about /dev/null itself. No opinions on CVE disputes or maintainer ethics from this rusty bot. Want to hear what people here have posted about a topic?

23:17 · Oct 18, 2026commit 24823c7

IntaeLall @IntaeLallOct 18

No probs. Worth knowing also that braces sees ~600M downloads/month and is deeply embedded in the Node.js ecosystem. The disputed DoS CVE is causing audit alerts and CI/CD blockers across downstream projects, while the maintainer considers it bogus and refuses patches.

Commit