Sign in
Deutsch English Español Polski
Low

brace-expansion Regular Expression Denial of Service vulnerability

  • Disclosed: 09.06.2025
  • Updated: 11.10.2026 10:22

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package brace-expansion >= 2.0.0, < 2.0.2, >= 1.0.0, < 1.1.12, >= 3.0.0, < 3.0.1, >= 4.0.0, < 4.0.1 2.0.2, 1.1.12, 3.0.1, 4.0.1

References

CVSS score 3.1/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness (CWE)
CWE-400
Platform
npm
Package
brace-expansion
Disclosed
09.06.2025
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-v6h2-p8h4-qcjw - CC BY 4.0

Vulnerability history: brace-expansion

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (10) in the archive
Total entries
10
First → latest
01.2018 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • High 6
  • Medium 3
  • Low 1

Disclosures per year

Severity:
  1. brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
    High · 7.5 CVE-2026-102278 >= 4.0.0, < 5.0.11, >= 3.0.0, < 3.0.8, >= 2.0.0, < 2.1.6, < 1.1.20 5.0.11, 3.0.8, 2.1.6, 1.1.20
  2. brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
    High · 7.5 CVE-2026-102276 >= 4.0.0, < 5.0.10, >= 3.0.0, < 3.0.7, >= 2.0.0, < 2.1.5, < 1.1.19 5.0.10, 3.0.7, 2.1.5, 1.1.19
  3. brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
    High · 7.5 CVE-2026-69152 < 1.1.18, >= 2.0.0, < 2.1.4, >= 3.0.0, < 3.0.6, >= 4.0.0, < 5.0.9 1.1.18, 2.1.4, 3.0.6, 5.0.9
  4. brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
    High · 7.5 CVE-2026-14257 >= 4.0.0, < 5.0.8, >= 3.0.0, < 3.0.3, >= 2.0.0, < 2.1.3, < 1.1.17 5.0.8, 3.0.3, 2.1.3, 1.1.17
  5. brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
    High · 5.3 CVE-2026-13149 >= 3.0.0, < 5.0.7, < 1.1.16, >= 2.0.0, < 2.1.2 5.0.7, 1.1.16, 2.1.2
  6. brace-expansion Regular Expression Denial of Service vulnerability this entry
    Low · 3.1 CVE-2025-5889 >= 2.0.0, < 2.0.2, >= 1.0.0, < 1.1.12, >= 3.0.0, < 3.0.1, >= 4.0.0, < 4.0.1 2.0.2, 1.1.12, 3.0.1, 4.0.1
  7. ReDoS in brace-expansion
    High · 7.5 CVE-2017-18077 < 1.1.7 1.1.7

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.