{"ecosystem":"npm","package":"brace-expansion","version":null,"bugs":[{"id":125,"ecosystem":"npm","package_name":"brace-expansion","affected_version":null,"fixed_version":"1.1.7","bug_id":"osv:GHSA-832h-xg76-4gv6","title":"ReDoS in brace-expansion","description":"Affected versions of `brace-expansion` are vulnerable to a regular expression denial of service condition.\n\n## Proof of Concept\n\n```\nvar expand = require('brace-expansion');\nexpand('{,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,\\n}');\n```\n\n\n## Recommendation\n\nUpdate to version 1.1.7 or later.","severity":"high","status":"fixed","source":"osv","source_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18077","labels":["CVE-2017-18077"],"created_at":"2026-04-19T04:30:13.365059+00:00","updated_at":"2026-04-19T04:30:13.365059+00:00"},{"id":126,"ecosystem":"npm","package_name":"brace-expansion","affected_version":"4.0.0","fixed_version":"5.0.5","bug_id":"osv:GHSA-f886-m6hf-6m8v","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","description":"### Impact\n\nA brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory.\n\nThe loop in question:\n\nhttps://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184\n\n`test()` is one of\n\nhttps://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113\n\nThe increment is computed as `Math.abs(0) = 0`, so the loop variable never advances. On a test machine, the process hangs for about 3.5 seconds and allocates roughly 1.9 GB of memory before throwing a `RangeError`. Setting max to any value has no effect because the limit is only checked at the output combination step, not during sequence generation.\n\nThis affects any application that passes untrusted strings to expand(), or by error sets a step value of `0`. That includes tools built on minimatch/glob that resolve patterns from CLI arguments or config files. The input needed is just 10 bytes.\n\n### Patches\n\n\nUpgrade to versions\n- 5.0.5+\n\nA step increment of 0 is now sanitized to 1, which matches bash behavior.\n\n### Workarounds\n\nSanitize strings passed to `expand()` to ensure a step value of `0` is not used.","severity":"medium","status":"fixed","source":"osv","source_url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v","labels":["CVE-2026-33750"],"created_at":"2026-04-19T04:30:13.366214+00:00","updated_at":"2026-04-19T04:30:13.366214+00:00"},{"id":127,"ecosystem":"npm","package_name":"brace-expansion","affected_version":"2.0.0","fixed_version":"2.0.2","bug_id":"osv:GHSA-v6h2-p8h4-qcjw","title":"brace-expansion Regular Expression Denial of Service vulnerability","description":"A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is `a5b98a4f30d7813266b221435e1eaaf25a1b0ac5`. It is recommended to upgrade the affected component.","severity":"low","status":"fixed","source":"osv","source_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5889","labels":["CVE-2025-5889"],"created_at":"2026-04-19T04:30:13.366973+00:00","updated_at":"2026-04-19T04:30:13.366973+00:00"}],"total":3,"_cache":"miss"}