Sign in
Deutsch English Español Polski
Medium

brace-expansion: Zero-step sequence causes process hang and memory exhaustion

  • Disclosed: 26.03.2026
  • Updated: 11.10.2026 10:22

Impact

A brace pattern with a zero step value (e.g., {1..2..0}) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory.

The loop in question:

https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184

test() is one of

https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113

The increment is computed as Math.abs(0) = 0, so the loop variable never advances. On a test machine, the process hangs for about 3.5 seconds and allocates roughly 1.9 GB of memory before throwing a RangeError. Setting max to any value has no effect because the limit is only checked at the output combination step, not during sequence generation.

This affects any application that passes untrusted strings to expand(), or by error sets a step value of 0. That includes tools built on minimatch/glob that resolve patterns from CLI arguments or config files. The input needed is just 10 bytes.

Patches

Upgrade to versions

  • 5.0.5+

A step increment of 0 is now sanitized to 1, which matches bash behavior.

Workarounds

Sanitize strings passed to expand() to ensure a step value of 0 is not used.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package brace-expansion >= 4.0.0, < 5.0.5, >= 3.0.0, < 3.0.2, >= 2.0.0, < 2.0.3, < 1.1.13 5.0.5, 3.0.2, 2.0.3, 1.1.13

References

CVSS score 6.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness (CWE)
CWE-400
Platform
npm
Package
brace-expansion
Disclosed
26.03.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-f886-m6hf-6m8v - CC BY 4.0

Vulnerability history: brace-expansion

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (10) in the archive
Total entries
10
First → latest
01.2018 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • High 6
  • Medium 3
  • Low 1

Disclosures per year

Severity:
  1. brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
    High · 7.5 CVE-2026-102278 >= 4.0.0, < 5.0.11, >= 3.0.0, < 3.0.8, >= 2.0.0, < 2.1.6, < 1.1.20 5.0.11, 3.0.8, 2.1.6, 1.1.20
  2. brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
    High · 7.5 CVE-2026-102276 >= 4.0.0, < 5.0.10, >= 3.0.0, < 3.0.7, >= 2.0.0, < 2.1.5, < 1.1.19 5.0.10, 3.0.7, 2.1.5, 1.1.19
  3. brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
    High · 7.5 CVE-2026-69152 < 1.1.18, >= 2.0.0, < 2.1.4, >= 3.0.0, < 3.0.6, >= 4.0.0, < 5.0.9 1.1.18, 2.1.4, 3.0.6, 5.0.9
  4. brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
    High · 7.5 CVE-2026-14257 >= 4.0.0, < 5.0.8, >= 3.0.0, < 3.0.3, >= 2.0.0, < 2.1.3, < 1.1.17 5.0.8, 3.0.3, 2.1.3, 1.1.17
  5. brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
    High · 5.3 CVE-2026-13149 >= 3.0.0, < 5.0.7, < 1.1.16, >= 2.0.0, < 2.1.2 5.0.7, 1.1.16, 2.1.2
  6. brace-expansion: Zero-step sequence causes process hang and memory exhaustion this entry
    Medium · 6.5 CVE-2026-33750 >= 4.0.0, < 5.0.5, >= 3.0.0, < 3.0.2, >= 2.0.0, < 2.0.3, < 1.1.13 5.0.5, 3.0.2, 2.0.3, 1.1.13
  7. ReDoS in brace-expansion
    High · 7.5 CVE-2017-18077 < 1.1.7 1.1.7

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.