Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@isaacs/brace-expansion

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7npmAmendedPublished

    @isaacs/brace-expansion has Uncontrolled Resource Consumption

    CVE-2026-25547 · GHSA-7h2j-956f-4vf2

    Affected
    • npm @isaacs/brace-expansion <= 5.0.0
    Fixed in
    5.0.1· Vendor fix available
    Issue
    @isaacs/brace-expansion is vulnerable to a Denial of Service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. Details The vulnerability occurs because @isaacs/brace-expansion expands brace expressions without any upper bound or complexity limit. Expansion is performed eagerly and synchronously, meaning the full result set is generated before returning control to the caller. For example, the following input: produces: This exponential growth can quickly overwhelm the event loop and heap memory, resulting in process termination. Proof of Concept The following script reliably triggers the issue. Create poc.js: Run it: The process will freeze and typically crash with an error such as:…

    Recommended action: Upgrade to 5.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →