trekhleb/javascript-algorithms

@babel/plugin-transform-modules-systemjs 7.29.0

1 advisory. Fixed in 7.29.4.

How it can be abusedThis Babel plugin runs during builds and tests and turns source files into different JavaScript. If an attacker could get a crafted file compiled here, the output could contain code that was never in the input. In practice this library only compiles its own trusted algorithm files, so only developers building or testing untrusted third-party JavaScript would be exposed.

• highGHSA-fv7c-fp4j-7gwp@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input

brace-expansion 2.0.2

3 advisories. Fixed in 5.0.7.

How it can be abusedbrace-expansion turns patterns like {a,b} into lists of strings. An attacker who can feed a crafted pattern to it could make expansion take huge amounts of time or memory and crash the process. In this project it only comes in indirectly through test tooling like glob/minimatch during development, so anyone running tests on trusted files could be slowed or crashed, but no real application code uses it.

• highGHSA-3jxr-9vmj-r5cpbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
• highGHSA-mh99-v99m-4gvgbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
• highGHSA-rgw5-rvv9-x895brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

flatted 3.3.3

2 advisories. Fixed in 3.4.0.

How it can be abusedThis package parses serialized data, and a crafted input could crash the process through runaway recursion or sneak properties onto core JavaScript objects. In this repo it only matters if flatted is actually used to parse untrusted input, which an offline algorithm catalog with no servers or user data does not do, so real users of the library are not meaningfully affected.

• highGHSA-25h7-pfq9-p65fflatted vulnerable to unbounded recursion DoS in parse() revive phase
• highGHSA-rf6f-7fwh-wjghPrototype Pollution via parse() in NodeJS flatted

js-yaml 3.14.2

2 advisories. Fixed in 3.15.0.

How it can be abusedAn attacker would need to feed this project a maliciously crafted YAML file so that parsing it burns excessive CPU and slows the machine down. Since this is an educational library that never parses YAML from users, the flaw only matters to developers running its own test tooling, not to anyone using the library.

• highGHSA-52cp-r559-cp3mjs-yaml: YAML merge-key chains can force quadratic CPU consumption
• highGHSA-5p4m-2wfm-xmqjJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

minimatch 9.0.5

3 advisories. Fixed in 10.2.3.

How it can be abusedAn attacker could send a crafted filename or pattern that makes minimatch hang while matching, freezing whatever process calls it. Here the library is only used indirectly by test tooling on local files, so no untrusted input reaches it and real users are not affected.

• highGHSA-23c5-xmqv-rm74minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
• highGHSA-3ppc-4f35-3m26minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
• highGHSA-7r86-cg39-jmmjminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

picomatch 4.0.3

1 advisory. Fixed in 4.0.4.

How it can be abusedAn attacker could send a specially crafted file-matching pattern that makes picomatch hang and burn CPU, freezing whatever process runs the matching. Here the library is only used by developer tools like Jest to match test files, so only someone running tests with attacker-supplied patterns would be affected.

• highGHSA-c2c7-rcm5-vvqjPicomatch has a ReDoS vulnerability via extglob quantifiers